The Biggest Data Breaches of 2019 so far

According to a report by Hiscox, the number of UK businesses reporting a cyber-attack increased to 61% in 2019, up from the previous year’s figure of 45%. We take a look at a few that have made the headlines.

The data also showed that losses from breaches jumped 61% from $229,000 (£176,000) to $369,000 (£281,600).

January – Governments and Collection 1

The first month of the year got off to poor start with a total of 1,769,185,063 leaked records reported. Here are just a few of the breaches.

Australia’s Victoria Government

The year was only a few hours old when the first major data breach of 2019 hit the headlines. Australia’s Victoria government announced that it had suffered a data breach that resulted in the addresses, phone numbers, email addresses and job titles of 30,000 public servants had been stolen. - https://techwireasia.com/2019/01/australia-reports-first-major-data-breach-of-the-year/

German Government Breach

The personal details of hundreds of German politicians including those of German Chancellor Angela Merkel were stolen and posted online. As well as that the contacts, private chats and financial details were put out on Twitter that belonged to figures from every political party except the AfD. According to the German government, the attack was a part of a global campaign carried by a Russian hacker group called Snake - https://www.bbc.co.uk/news/world-europe-46757009

Town of Salem breach

Online role-playing videogame The Town of Salem suffered a huge data breach that exposed the private details of 7 million users. The stolen data included usernames, emails, passwords, IP addresses, game and forum activity, and some payment card information. - https://www.scmagazineuk.com/town-salem-breach-affects-seven-million-accounts/article/1521993

Ascension Server Breach

Up to 24 million financial and banking documents representing tens of thousands of loans and mortgages from some of the biggest banks in the USA, was exposed online after being discovered on an open server. – https://www.housingwire.com/articles/48007-massive-data-breach-involving-millions-of-mortgage-documents-just-got-much-worse

Collection 1

The largest data dump in history was discovered in January. It contained the details of a staggering 770 million people. The files were found on cloud service MEGA and later posted to a popular hacking forum. The Collection 1 folder contained 12,000 files and was 87 gigabytes in size. - https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/

February – Banks bear the brunt

Metrobank

Metrobank became the first bank to disclose that it had been attacked by a new type of cyber-attack. The UK based bank reportedly fell victim to a 2FA bypass attack after cyber-criminals were able to compromise a known flaw in the SS7 protocol. The technique allowed hackers to bypass 2FA and proceed to empty a victim’s bank accounts. - https://www.computing.co.uk/ctg/opinion/3070740/the-metro-bank-sms-authentication-hack-shows-the-risk-of-relying-on-ancient-protocols-for-security

Bank of Valletta

Malta’s Bank of Valletta was hit by a cyber-attack that resulted in the bank temporarily suspending all of its services including ATMs and even its website twice in the space of two weeks. The hackers stole $14 million but fortunately, the bank was able to track the accounts and recover the money. The cost of the outage to services has not been disclosed.  - https://www.finextra.com/newsarticle/33403/bank-of-valletta-turns-off-the-lights-as-cyber-attackers-strike

Apex Human Capital Management

The payroll software provider Apex Human Capital Management was hit by a ransomware attack that severely disrupted the payroll management services for hundreds of its customers. The disruption lasted for three days. In the face of a potentially long-term outage, Apex paid the ransom. The company did not disclose how much it paid. - https://krebsonsecurity.com/2019/02/payroll-provider-gives-extortionists-a-payday/

Multiple Sites 

Security researchers stumbled upon a vast trove of stolen data that was being sold on the Dark Web. The hacker in question was aiming to sell the details of 617 million stolen online accounts for 20,000 Bitcoin. The data included stolen data from; Dubsmash (162 million), MyFitnessPal (151 million), MyHeritage (92 million), ShareThis (41 million), HauteLook (28 million), Animoto (25 million), EyeEm (22 million), 8fit (20 million), Whitepages (18 million), Fotolog (16 million), 500px (15 million), Armor Games (11 million), BookMate (8 million), CoffeeMeetsBagel (6 million), Artsy (1 million), and DataCamp (700,000) - https://www.theregister.co.uk/2019/02/11/620_million_hacked_accounts_dark_web/

March – Factories, manufacturers and a huge breach

March was another huge month in terms of the number of reported data breaches with a whopping 2.1 billion records compromised. Here are just a few incidents that made the headlines.

Norsk Hydro Aluminium factories –

One of the world’s largest aluminium producers was forced to revert to manual operations at some of its plants after being hit by a Ransomware attack. The malware forced some of the company’s factories to stop production staff worldwide were warned not to use their computers. According to reports, lost production as a result of the attack cost Norsk Hydro $41 million. - https://www.computerweekly.com/news/252460340/Norsk-Hydro-cyber-attack-cost-estimates-up-to-41m

Hexion and Momentive –

In the same week, as Norsk Hydro was hit, two chemical companies fell victim to the same ransomware. The two US-based companies were forced to purchase hundreds of new computers following the attack and it was revealed that much of the data contained on the infected devices were lost. - https://motherboard.vice.com/en_us/article/8xyj7g/ransomware-forces-two-chemical-companies-to-order-hundreds-of-new-computers

Verifications.io-

Security researchers discover that Verifications.io, a self-described "big data email verification platform," suffered a data breach that exposed 763 million records. The data included email addresses, names, gender, IP addresses, phone numbers and other personal information. The amount of exposed surpassed even the Collection 1 discovery. - https://www.idtheftcenter.org/763-million-records-exposed-in-verifications-io-data-breach/

Facebook –

An internal breach at Facebook resulted in the passwords of 600 million Facebook users being exposed in plain text on a company server. According to security researchers, some of the exposed passwords had been visible since 2012. Although Facebook said that the passwords were not exposed to anyone outside the company there are 20,000 employees that could have gained access to them. - https://www.itgovernance.co.uk/blog/utter-zuck-up-600-million-passwords-exposed-in-facebook-data-breach

For Further Reading Visit –

The Cybersecurity Dream team of CyberScore™ and Cyber Posture Assessments

Cybersecurity Needs to Change; it’s needlessly complex

Reassure your customers with Cyber Essentials

Take Control with CyberScore™

Businesses of all sizes can take control of their cybersecurity by using the award-winning CyberScore™. CyberScore™ is an automated testing service that allows you to take control of your cybersecurity by detecting vulnerabilities and providing you with empirical evidence and Get-Well plans. The score itself also allows you to clearly demonstrate to the board simply where your organisation currently stands in terms of its cyber risk rating and security posture

XQ Cyber also offers a range of incident response and consultancy services such as Penetration Testing, Cyber Posture Assessments and Incident Response preparedness and testing.

Follow us on FacebookTwitter and LinkedIn and join the CyberScore Community