2019 marks the end of another decade. With the proliferation of the Internet, networks, and sophisticated devices, one crucial thing the last 10 years should have taught us is this: never take online security lightly.
The IT and cybersecurity field continues to grow – and will continue to grow – to protect systems from data theft, cyber attacks, compromised access, and other damages. Regulatory penalties are an increasing concern in the U.S. as more states enact data breach laws to protect consumers’ privacy, following the implementation of the EU GDPR. Any lapse in security leading to a data breach could lead not only to severe financial loss but also a loss of consumer confidence.
Businesses and organizations, however, aren’t the only ones that should recognize the importance of cyber security. History has shown that even governments and government institutions are not immune to committing cyber security shortcomings.
Cyber security history goes way back to the 1970s – from the Creeper virus and the first DoS attack to the AIDS Trojan and the infamous ILOVEYOU virus. In this article, however, we’ll focus on some of the most notable events in cyber security history in the last 10 years
2011 - Sony’s PlayStation Network and Sony Pictures Suffers Multiple Attacks
Screenshot via Sony Pictures
2011 was a banner year for electronics conglomerate Sony, although not in a good way. Sony has become one of the most commonly cited cyber attack examples of this decade.
- The PlayStation Network (PSN), Sony’s online gaming service, was attacked in April 2011. The event leaked the user data of 77M users, including names, passwords, emails, and more. Unable to control the spread of the breach, Sony's PSN platform suffered an outage for 23 days.
- Sony Online Entertainment (the company’s game developer and publisher) and Qriocity (Sony’s streaming service) were also closed for a month.
Sony was not only fined $400,000 by authorities in the U.K. for the above events; the company also ended up compensating the affected players in the form of digital goods.
Still, Sony’s troubles that year weren’t finished yet. Sony experienced a second security breach, this time by hackers’ group LulzSec. Hackers said the names, credit card details, and other data they stole from Sony Pictures’ websites were unencrypted. According to LulzSec’s press release, "Sony stored over 1,000,000 passwords of its customers in plaintext… which means it's just a matter of taking it."
2012 - Global Payment Systems Data Breach
In April 2012, Global Payment Systems revealed a data breach due to a cyber attack. Global Payment Systems is one of the largest third-party payment system providers.
initially estimated that 1.5 million accounts were exposed. However, further news reports suggested that the number of breached accounts could go as high as seven million. As a consequence, the company incurred a huge expense of $93.9 million.
2013 - Cyber Attacks on the Singaporean Government
Anonymous, perhaps one the more iconic hacking groups in the world from the early 2000s, was linked to several security events in the news around this time. The group, an international hacktivist group which started in 2003 and was responsible for several high-profile cyber attacks against governments and large organizations, initiated a series of cyber attacks on the Singaporean government in 2013. One reason for the attacks was purportedly Singapore’s web censorship regulations, particularly on news outlets. James “The Messiah” Raj, an Anonymous representative, was eventually later charged that year in a Singapore court.
2013 - #OpIsrael Coordinated Yearly Cyber Attack
#OpIsrael, an “anti-Israel" attack, is a yearly, coordinated cyber attack done by hacktivists towards Israel’s government and private websites. The first #OpIsrael in 2013 was performed by Anonymous on the eve of Holocaust Remembrance Day. Per Israel’s National Cyber Bureau and security experts, that inaugural event was a failure.
2013 - Adobe
Screenshot via Adobe
Despite being one of the most recognizable names in software, Adobe announced in October 2013 that its system was massively hacked.
Over 38 million users and over 152 million breached records were involved in the incident. To perform the hack, the perpetrators took advantage of Adobe’s poor encryption practices, but that’s not all: Hackers were also able to obtain over 40 GB of source code for three Adobe programs: Acrobat, ColdFusion, and ColdFusion Builder.
Adobe was eventually fined $1 million for the said incident.
2013 - Edward Snowden Leaks Classified NSA Documents
Edward Snowden was previously an employee of the CIA (Central Intelligence Agency) but it wasn't until 2013 that he became infamous for the highly controversial act of leaking classified cybersecurity information from the NSA (National Security Agency).
In 2013, two prominent news outlets – The Washington Post and The Guardian – published Snowden’s acquired documents. These publications exposed the large-scale surveillance done by the NSA. While Snowden’s act may not go down as the biggest insider act in history, it was so controversial that it continues to generate much discussion today, even among ordinary citizens.
2013 and 2014 – Target and Home Depot Credit Card Data Stolen
It wasn't until December 2013, when credit and debit card data belonging to Target shoppers surfaced on Rescator, a Ukrainian cybercrime shop, that the cybersecurity world realized something especially massive was afoot.
- During Thanksgiving break of November 2013, Target's point of sale system was infected with malware. Customers who shopped between November 27th and December 15th of 2013 were affected. A year later, card data surfaced on Rescator. This time the card data belonged to Home Depot customers.
- Data from 110M Target consumers, including PIN data, names, credit/debit card numbers, and expiration dates were leaked. Later on, data belonging to 56M Home Depot consumers was leaked.
2013 and 2014 - Yahoo! Suffers a Massive Data Breach
Screenshot via Yahoo!
In late 2014, pioneer Internet company Yahoo! experienced one of the biggest (if not the biggest) data breach in history. In this attack, a total of 500 million Yahoo! users were compromised. Every credential – names, passwords, answers to security questions – were stolen.
There’s also a separate report that Yahoo! had an earlier breach in 2013. The initial estimate of breached accounts in this particular incident was 1 billion users. Later, Yahoo! confirmed that the total number of impacted users for this breach was actually 3 billion!
What’s worse, Yahoo! didn’t report these breaches until 2016. The Securities and Exchange Commission (SEC) fined Yahoo! $35 million for untimely reporting. More than 40 class-action lawsuits were filed against Yahoo! The events also brought down the company’s sale price by around $350 million.
2014 - Sony Dealt Another Blow with Attack on Sony Pictures Entertainment
Three years after Sony’s 2011 breaches, Sony was dealt another blow. The group Guardians of Peace claimed to have hacked Sony Pictures Entertainment’s network. They stole 100 TB of data, which included film scripts, emails, and personal data of Sony employees. Sony had to cancel the airing of some of its movies and paid compensation to current and former employees.
2015 – Experian Data Breach Compromises 15 Million Records
Experian announced a data breach in 2015, compromising sensitive data of around 15 million people who applied for a T-Mobile telecom service. Experian is one of the three largest U.S. credit bureaus (along with Equifax and TransUnion).
So how did a credit agency like Experian get into such a mess?
In 2012, Experian acquired Court Ventures, a company which collates information from public records. At that time, Court Ventures got an existing contractual agreement with US Info Search. Under this contract, US Info Search’s customers could access company data to find people’s addresses that would help in reviewing court records.
Court Ventures then sold information to several third parties, one of which was a Vietnamese ID theft ring that was able to access personal information of Americans, like social security numbers and financial details.
2015 to 2016 - WikiLeaks and the Democratic National Committee
Screenshot via WikiLeaks
Russian cyber espionage groups Cozy Bear and Fancy Bear were identified to have hacked Democratic National Committee (DNC) emails. Why would they do that? Analysts said the action was possibly an attempt to influence the 2016 U.S. presidential elections. The cyber attacks supposedly happened sometime between 2015 and 2016. The hackers were able to access DNC’s networks, resulting in a massive data breach.
Based on investigations, specific individuals provided WikiLeaks with the stolen emails. WikiLeaks then published these documents. This event is claimed to be another one of those notorious leaks in recent U.S. history.
2015 – Snapchat Users Personal Information Leaked
In 2015, messaging app service Snapchat was exposed for being not so anonymous at all. Hackers posted usernames, phone numbers, and location of 4.6 million accounts. This alarmed thousands of Snapchat users, especially those who use the app to share intimate pictures.
Snapchat was said to have been warned by hackers to address the vulnerability, but the company did not act. While Snapchat users didn’t lose money here, it took over a year for the company to recover from this incident.
2015 - Office of Personnel Management (OPM) Suffers Significant Data Breach
In April 2015, the U.S. Office of Personnel Management (OPM) discovered that it was hacked. The incident was dubbed as one of the most significant breaches of government data in U.S. history.
Based on OPM and an inter-agency team’s investigation, “sensitive information, including the Social Security Numbers (SSNs) of 21.5 million individuals, was stolen from the background investigation databases… including 19.7 million individuals that applied for a background investigation, and 1.8 million non-applicants..." The breach also included findings from interviews conducted by background investigators and approximately 5.6M fingerprints.
The hack was believed to have been perpetrated by Chinese hackers. China denied any involvement in the cyber attack.
2015 - Ashley Madison Hackers Publish Users’ Email Addresses
Hacker group The Impact Team breached extramarital dating website Ashley Madison in July 2015. The site is managed by Ruby Corp., previously Avid Life Media.
According to hackers, they took not only company data but also the data of 37 million users. To prove their point, the hackers released emails of the company’s CEO. They even threatened to release the users’ data unless the site was shut down.
Avid Life Media, however, did not heed the warning. Hackers eventually dumped 9.7 gigabytes of data on 32 million users. CEO Noel Biderman resigned after a second data dump by the hackers but Ashley Madison's site remained operational.
If you’re interested in other data breaches from 2015, check out the list in this blog.
2016 - General Data Protection Regulation (GDPR) Adopted by the EU
This one is not a security breach or cyber attack, but it’s an important milestone nonetheless.
The General Data Protection Regulation (GDPR) was adopted in the European Union in April 2016. Fully in effect as of mid-2018, the GDPR is a framework for providing data protection and privacy for those residing within the EU and the European Economic Area (EEA).
One primary requirement of GDPR is that business processes handling personal data must have data protection built in by design and by default. Organizations are also required to have a Data Protection Officer (DPO).
2017 – Equifax Breach Results in Compromised Data for Nearly 150 Million
In 2017, another big credit bureau was mired in a recent data breach: Equifax.
Equifax failed to apply patches to correct a vulnerability in Apache Struts. This jeopardized the data of 147.9 million Americans, as well as Canadian and British nationals. Hackers obtained access to roughly 209,000 credit card details and social security numbers.
While it happened years ago, the Equifax breach could have far-reaching effects, particularly when it comes to exposing victims to future ID thefts. What happened to Equifax also brought up a valid question: Whether it’s okay to centralize credit reporting agencies.
2017 - Shadow Brokers Leaks NSA Hacking Tools
The Shadow Brokers are an anonymous group which stole and leaked hacking tools from NSA (National Security Agency). As computers running on Windows were the ones affected, Microsoft provided a patch. However, many users didn’t install the patch and were compromised.
The leaked tools led to other cyber security incidents in 2017, including NotPetya and WannaCry.
2017 – The World’s First Ransomworm: WannaCry
As the world’s first “ransomworm” (ransomware cryptoworm), WannaCry affected 230,000 Windows-operated computers across 150 countries. It spread through EternalBlue, an exploit made by the NSA. (EternalBlue was one of the tools stolen and leaked by the Shadow Brokers.) The perpetrators demanded ransom payments of $300 in Bitcoin cryptocurrency in exchange for unlocking files encrypted by WannaCry.
2017 - NotPetya
The NotPetya ransomware affected over 12,500 computers and did more than just lock data for a ransom; it also prevented computers from working all together.
NotPetya also wiped data clean from of global businesses, including prominent shipping companies FedEx and Maersk, Russian oil and gas company Rosneft, and British advertiser WPP. As a matter of fact, FedEx claimed a $300 million loss on the attack. One of its subsidiaries even had to suspend operations.
2017 - Bad Rabbit Masquerades as an Adobe Flash Update
Another ransomware that made headlines in 2017, Bad Rabbit sneaked into computers by pretending to be an Adobe Flash update. It was able to do this through compromised media websites. This ransomware strain affected around 200 targets in Russia, Ukraine, and Bulgaria.
For other devastating ransomware in cyber security history, you can check out this blog.
2017 – Uber Suffers Breach Impacting 57 Million Customer Data Points
Screenshot via Uber
Hackers stole 50M names, home addresses, mobile phone numbers, and emails of people who had users Uber and the driver's licenses and other information of seven million drivers. To make matters worse, Uber paid the hackers $100,000 to cover up the breach. The transportation network company didn’t disclose this issue until November 2017. This angered customers and prompted three U.S. senators to introduce a bill that would give jail time to corporate executives who conceal a breach.
2018 – Facebook Plagued by Privacy Concerns
In terms of cyber attacks and data breaches, 2018 witnessed several notable incidents. Social media giant Facebook was quickly became one of the most controversial data breach examples.
In 2018, Facebook was placed under federal investigation for striking a deal with electronics manufacturers to access user data. Later on, Facebook was hit with several security breaches. One of these involved analytics firm Cambridge Analytica, which got access to data of more than 87 million users - far higher than the 50 million users initially reported. That 50 million figure eventually came back into play in September that month, when the company revealed that there was another incident which exposed the data of 50 million Facebook users.
2018 – 92 Million MyHeritage Users’ Account Details Compromised
In mid-2018, online genealogy website MyHeritage announced that it had experienced a security breach.
The attacker accessed an archive containing account details of at least 92 million MyHeritage users. Thankfully the archive only contained emails and hashed passwords, no payment details or DNA tests. It’s unclear if the incident resulted from a hacker attack or by a malicious insider intending to sell those data.
2018 - Marriott Cyber Attack Goes Unnoticed for Years
Screenshot via Marriott Hotels
Breaches can lay dormant for a long time before they get discovered, and that’s what happened in Marriott Hotels’ case. When its Starwood Hotels database was compromised, it exposed the personal details of around 500 million Marriott guests. The incident was believed to have begun way back in 2014!
U.S. government investigators increasingly believe that Chinese state hackers were responsible for that intrustion. China's Ministry of Foreign Affairs denied any knowledge. The company faces a $123 million fine for failing to protect customer data, the second major fine handed down by UK regulators in the summer of 2019.
2018 – Hundreds of Thousands of Records Breached in British Airways Cyber Attack
15 months after British Airways’ system failure at Heathrow Airport, the airline company apologized to customers for cyber attacks between August and September of 2018. Around 500,000 card payments were affected in this breach. Hackers stole names, emails, addresses, and credit card numbers, among other data.
British Airways faces a $230 million GDPR fine, about 1.5% of its 2017 revenue, over the breach.
2018 - California Consumer Privacy Act (CCPA) Signed Into Law
Like the EU’s GDPR, the California Consumer Privacy Act (CCPA) is another regulation aimed to protect privacy. It’s meant to enhance privacy rights and consumer protection for California residents. It was signed into law in mid-2018 and will become effective by 2020.
2019 - Breaches in Singapore’s Health Sectors
In early 2019, Singapore had already been hit by two data breaches.
In January, personal data of 808,000 blood donors were found online. The data were reportedly mishandled by Secur Solutions Group, a vendor of Singapore’s Health Sciences Authority (HSA). Posted data include names, ID card numbers, gender, dates of the last three donations, and in some instances, blood type, height, and weight.
January hadn’t ended when another incident broke out. This time, the HIV status of 14,200 people were leaked online. The perpetrator of the leak - he was eventually found guilty in a U.S. court for trying to extort the Singaporean government over the information - was Mikhy Farrera- Brochez. He got access to the HIV registry through his partner Ler Teck Siang, a former doctor and director of the Ministry of Health’s National Public Health Unit.
Why is cybersecurity important?
Like death and taxes, data breaches and cyber attacks are expected. This list hasn’t exhausted all that occurred in the last 10 years. But moving forward, cybersecurity remains under threat, with effects becoming more significant than ever.
The past decade has been a tumultuous one in the cybersecurity world. As hackers develop increasingly sophisticated attack measures, companies of all sizes should be poised to defend and protect their data from even more serious cyber attacks in the coming years.
It’s crucial then to equip ourselves or our organizations with all the necessary protection we can get.
Learn how Digital Guardian can help address your most significant security threats.
