17 Feb 10 Famous Cloud Security Data Breaches That Shocked the World
The cloud is one of the most revolutionary inventions in the 21st century. Not only does it make accessing important files and documents a lot simpler, but it also allows organizations to employ dynamic strategies such as remote work.
Yet despite the significant benefits that such access has to offer, the cloud is still one of the most targeted systems by malicious individuals.
In fact, Proofpoint found that 72% of companies that used cloud solutions have been targeted by threat actors. They also learned that cybercriminals were able to successfully breach 15 out of every 10,000 active cloud user accounts.
To give you an idea of the gravity of the situation, we’ve compiled a list of the top 10 cloud security data breaches that shocked the world. Let’s take a look at each one below.
Biggest Data Breaches in History
1. Yahoo
The cloud security data breaches that happened to Yahoo were some of the worst in history. The severity of the breaches wasn’t the only factor that made them bad, but also because of the way the web services provider handled the situation.
There were two data breaches that occurred in 2013 and 2014 respectively, but Yahoo only revealed their discoveries a few years later. The first breach that they announced impacted more than 500 million Yahoo user accounts while the second affected all 3 billion of its existing profiles.
Some of the data that hackers were able to obtain from the breaches included personal names, email addresses, phone numbers, and hashed passwords. Yahoo has been intensely criticized for these late disclosures and is currently facing investigations and lawsuits.
2. Alibaba
November 2019 saw the shopping website of Alibaba, Taobao, affected by a major cyberattack. This led to more than a billion pieces of user information accessed and gathered by a malicious individual. Taobao is a popular shopping platform based in China that has more than 710 million customers each month.
The attacker used a web-crawling app that collected details such as user IDs and mobile phone numbers. They illegally acquired user information through the software from November 2019 to July 2020 until Alibaba learned about the suspicious activity and informed the authorities.
At the end of the investigation, they learned that it was a Chinese software developer and their employer who instigated the crime. The two were sentenced to 3 years in prison and fined $70,260.
3. LinkedIn
A hacker made an announcement on June 22, 2021 that they were selling more than 700,000 personal details coming from the social networking platform, LinkedIn. A report found that nearly all of its users were affected by a malicious attack known as data scraping.
Although most of the information accessed in the leak is available to the public, the hacker was still able to obtain email addresses that are not readily seen on LinkedIn profiles. For threat actors, these email addresses are gateways that can lead to real-life names of individuals who can be targeted for various purposes.
4. Sina Weibo
A breach that occurred around mid-2019 resulted in information from the Chinese social network Weibo being available for sale on the dark web. 538 million Weibo users were threatened to have their account information leaked for as little as $250.
Although the breach didn’t result in payment details or passwords being gathered, it still would lead to private data from the platform’s users being accessible by anyone who wishes to purchase them. Full names, genders, locations, and even phone numbers of users were compromised during the breach.
5. Facebook
User information from more than 500 million Facebook users was leaked online via an underground website that is being used by shady individuals. The breach is believed to be connected to a 2019 vulnerability that the platform claims to have fixed.
Although no one can verify the source of the information exactly, many assume that it was done by exploiting vulnerabilities in Facebook’s system. In this case, cybercriminals were able to acquire personal information from users by using harvesting techniques.
6. Marriot International
In an announcement made in late 2018, the hotel services provider Marriot International revealed that one of its reservation systems had been accessed by attackers. The incident led to customer information – which included passport numbers and credit cards – being obtained by the cybercriminals.
During the investigation, Marriott learned that the breach was caused by an attacker who took control of an account with administrator privileges.
7. Adult Friend Finder
The Adult Friend Finder breach was an incident that occurred in 2016 that resulted in six of its databases and the information of more than 400 million users to have been accessed illegally. Usernames and passwords of individuals were stolen, along with details from 15 million deleted accounts.
Apart from Adult Friend Finder, data from accounts created within the Cams.com and Penthouse.com websites were also affected in the data breach. The hack led to the attackers gaining access to sensitive information such as the sexual preferences, purchases made, and extramarital affairs of its members.
8. Accenture
The IT consultancy company, Accenture, confirmed the rumors that ransomware operators were able to steal data from their systems during a cyberattack on August 2021. The organization revealed the data breach during its fourth-quarter financial report.
The cybercriminals who were responsible for the LockBit ransomware attack on Accenture claims to have obtained 6 terabytes worth of data from the company’s network. They went on to demand a $50 million ransom for their return.
9. Verizon
In 2017, a problematic AWS S3 configuration led to Verizon’s associate, Nice Systems, to expose personal information from many of its users. The breach only became possible to an error made by their partner that further led to customer call data being leaked.
Additionally, Verizon also learned about 29,207 security incidents with 5,200 of these being confirmed breaches.
Some of the types of attacks that battered the telecom giant included DDoS attempts, client-side app infections, and social engineering tactics. All of these have led to system breaches within the organization.
10. State Farm
The insurance and financial service provider, State Farm, was also a victim of a data breach that was caused by a stuffing attack on user credentials. Its attacker tried to enter the State Farm cloud service by using a stolen password in a separate data breach.
State Farm went on to inform its customers that no unauthorized access to user accounts had been made, yet there was no proof to back up this claim.
Conclusion
These are the top 10 cloud security data breaches that shocked the world in recent memory. Many of these attacks have led to countless user information being leaked to the public and the dark web. This means that anyone who has access to these networks could potentially obtain data such as usernames, passwords, and other personal details.
For companies, possessing the right cybersecurity measures, knowledge, and employee training are important to minimize the chances of experiencing a data breach.