The year 2018 is coming to an end, which means it's time to sum up its results and list the most significant data breaches.
Only really large cases of information leaks around the world got into this review. However, even despite the high cut-off threshold, there are so many cases of leaks that the review had to be divided into two parts - by six months.
Let's see what and how leaked this year from January to June. Iβll make a reservation right away that the month of the incident is indicated not by the time of its occurrence, but by the time of disclosure (public announcement).
Here we go ...
January
-
Progressive Conservative Party of Canada
The information management system (Constituent Information Management System - CIMS) of the Progressive Conservative Party of Canada (Chapter in Ontario) was hacked.
The stolen database contained the names, phone numbers and other personal information of more than 1 million Ontario voters, as well as party supporters, sponsors and volunteers. -
Rosobrnadzor
Leakage of information about diplomas and other personal data accompanying them from the website of the Federal Service for Supervision in Education and Science.
In total, there are about 14 million records with data on former students. Database size 5 GB.
Leaked: series and number of diploma, year of admission, year of graduation, SNILS, TIN, series and number of passport, date of birth, nationality, educational organization that issued the document. -
Norwegian Regional Health Authority
Attackers hacked into the system of the Regional Health Authority for Southern and Eastern Norway (Helse SΓΈr-Γst RHF) and gained access to personal data and medical records of about 2.9 million Norwegians (more than half of all inhabitants of the country).
The stolen medical data contained information about government officials, the secret service, the military, politicians and other public figures.
February
- Swisscom
The Swiss mobile operator Swisscom admitted that the personal data of about 800 of its customers were compromised.
The names, addresses, phone numbers and dates of birth of customers were affected.
March
-
Under Armour
The popular fitness and nutrition app MyFitnessPal, owned by Under Armor, has been the cause of a massive data breach. About 150 million users are affected, according to the company.
The attackers learned usernames, email addresses, and hashed passwords. -
Orbitz
Expedia Inc. (owns Orbitz) said it had discovered a data breach on one of its old sites affecting thousands of customers.
It is estimated that the leak affected about 880 thousand bank cards.
The attacker gained access to data about purchases made between January 2016 and December 2017. The stolen information includes dates of birth, addresses, full names and payment card details. -
MBM Company Inc.
Amazon S3 (AWS) public storage was discovered in the public domain, containing a backup copy of an MS SQL database with personal information of 1.3 million people living in the US and Canada.
The database was owned by MBM Company Inc, a Chicago-based jewelry company operating under the brand name Limoges Jewelry.
The database contained names, addresses, zip codes, phone numbers, email addresses, IP addresses, and text passwords. In addition, there were MBM Company Inc's internal mailing lists, encrypted credit card information, payment information, promo codes, and item orders.
April
-
Delta Air Lines, Best Buy and Sears Holding Corp.
Targeted attack of special malware on the online chat application of the company [24]7.ai (a California company from San Jose, develops applications for online customer service).
The complete details of bank cards were leaked - card numbers, CVV codes, expiration dates, names and addresses of holders.
Only an approximate amount of leaked data is known. For Sears Holding Corp. this is a little less than 100 thousand bank cards, for Delta Air Lines it is hundreds of thousands of cards (the airline does not say more precisely). The number of compromised cards for Best Buy is unknown. All cards leaked between September 26 and October 12, 2017.
It took [24]7.ai more than 5 months after the discovery of the attack on its service to notify customers (Delta, Best Buy and Sears) about the incident. -
Panera Bread
A file with the personal data of more than 37 million customers was simply lying in plaintext on the website of a network of popular bakery cafes.
The leaked data included customer names, email addresses, dates of birth, postal addresses, and the last four digits of credit card numbers. -
Saks, Lord & Taylor
More than 5 million bank cards were stolen from the Saks Fifth Avenue retail chains (including the Saks Fifth Avenue OFF 5TH chain) and Lord & Taylor.
Hackers used special software in cash registers and PoS terminals to steal card data. -
careem
The personal data of approximately 14 million people in the Middle East, North Africa, Pakistan and Turkey was stolen by hackers during a cyber attack on the servers of Careem (Uber's biggest competitor in the Middle East).
The company has discovered a breach in a computer system that stores customer and driver credentials from 13 countries.
Names, email addresses, phone numbers, and travel data were stolen.
May
- South Africa
A database containing the personal data of approximately 1 million South Africans has been discovered in the public domain on a public web server owned by a company that processes electronic payments for traffic fines.
The database contained names, identification numbers, e-mail addresses and passwords in plain text.
June
-
Exactis
Exactis, a marketing company in Florida, USA, held an Elasticsearch database of about 2 terabytes in size, containing more than 340 million records, in the public domain.
About 230 million personal data of individuals (adults) and about 110 million contacts of various organizations were found in the database.
It is worth noting that in total, about 249.5 million adults live in the United States - that is, we can say that the database contains information about every adult American. -
Sacramento Bee
Unidentified hackers have stolen two databases belonging to the Californian newspaper The Sacramento Bee.
The first database contained 19.4 million records with personal data of California voters.
The second base contained 53 entries with information about newspaper subscribers. -
ticketfly
Concert ticketing service Ticketfly, owned by Eventbrite, has reported a hacker attack on its database.
The client base of the service was stolen by the hacker IsHaKdZ, who demanded $7502 in bitcoins for its non-distribution.
The database contained the names, postal addresses, phone numbers, and email addresses of Ticketfly customers and even some of the service's employees, totaling over 27 million records. -
MyHeritage
92 million accounts (logins, password hashes) of the Israeli genealogical service MyHeritage leaked. The service stores the DNA information of users and builds their family trees. -
Dixons Carphone
Electronics chain Dixons Carphone, which has retail stores in the UK and Cyprus, said that 1.2 million customer personal data, including names, addresses and email addresses, were leaked as a result of unauthorized access to the company's IT infrastructure.
In addition, the numbers of 105 bank cards without a built-in chip were leaked.
To be continued ...
Regular news about individual cases of data leaks are promptly published on the channel .
Source: habr.com