Let us start the new year with some positive news. Despite the coronavirus pandemic, the number of data breaches in 2020 fell by 52%, at least in the first six months anyway.
That said, we’ve still seen a large number of high-profile cases, some of which involving billions of exposed records.
Top Data Breaches of 2020
Below is a round-up of the 20 biggest data breaches we saw in 2020.
|The United States Federal Government||Emails and other documents were stolen in a cyberattack that was said to be “among the worst cyber-espionage ever suffered by the U.S”, affecting at least 200 organizations around the world. The attackers exploited software from at least three U.S. firms: Microsoft, SolarWinds, and VMware.||The breach was first publicly reported on December 13, 2020, although the initial attack began no later than March 2020./td>|
|CAM4.com||A database containing 10.88 billion records was exposed to the internet on a misconfigured Elasticsearch cluster.||The leak was discovered on March 16, 2020.|
|Advanced Info Service (AIS)||A database containing approximately 8 billion records was exposed to the internet without a password.||AIS were alerted about the open database on May 13, 2020|
|Keepnet Labs||A database containing approximately 5 billion records was exposed for 24 hours by one of Keepnet’s contractors.||The database was indexed on the 15 of March, and was exposed until the 16th of March, 2020.|
|BlueKai||Approximately 4 billion records were exposed due to an unsecured database. The data that was exposed included names, home addresses, email addresses and web browsing activity – including purchases and newsletter subscription information.||Technically speaking, the breach took place towards the end of 2019 (November). However, given the scale of the incident, I thought it was worth adding to the 2020 list.|
|Whisper||An unprotected database containing 900 million “secret confessions” was exposed to the internet. The Whisper posts, including additional information, such as a user’s age, ethnicity, gender, home-town, nickname and group membership, were later found online.||The exact date of exposure is not clear, however, the story was first published by the Washington Post on March 10, 2020.|
|Estée Lauder||An unsecured database containing approximately million records was exposed to the Internet.||The exposed database was discovered on January 30, 2020.|
|Broadvoice||Over 350 million customer records were leaked due to a configuration error, which lead to several online databases being exposed to the Internet.||The unprotected Elasticsearch database was discovered by researcher, Bob Diachenko, on the 1st of October, 2020.|
|Wattpad||The credentials of approximately 268 million users were leaked from a compromised Wattpad database. The credentials were unique email address and password combinations.||Researchers from Risk Based Security discovered the breach on July 14, 2020, although Wattpad were originally breached in June 2020.|
|Microsoft||Approximately 250 million records were exposed when a cloud-based database used for “support case analytics” became visible to the Internet.||The database was exposed between the 5th of December and the 31st of December, 2019.|
|Instagram, Tik Tok And YouTube||A database belonging to Social Data – a company that sells social media data to marketers – was exposed to the Internet. The database contained personally identifiable information (PII) belonging to users of Instagram, Tik Tok And YouTube, and consisted of names, contact information, images and statistics about followers.||The data was exposed on August 1, 2020.|
|Tetrad||Security researchers have discovered a publicly exposed Amazon S3 bucket containing personal data and behavioural profiles belonging to 120 million Americans.||Security company UpGuard found the misconfigured bucket on February 3, 2020.|
|Antheus Tecnologia||An Elasticsearch server containing over 81.5 million records was exposed to the Internet. The records consisted of employee emails and telephone numbers, and 76,000 unique fingerprints.||Security research team SafetyDetectives discovered the leak in March, 2020.|
|Wishbone||Personal details of over 40 million users have been put up for sale by hackers on the dark web for 0.85 bitcoin (£6,445). These details include names, email addresses, phone numbers, geographical locations, genders, social media profiles, and hashed account passwords of users.||The Wishbone user database was leaked in full in May, 2020.|
|EasyJet||Email addresses and travel details of around 9 million people were stolen, and around 2,208 also had their payment card details ‘accessed’, in a ‘highly sophisticated cyber attack’.||The attack took place in January 2020.|
|Marriott International||Around 5.2 million guests were affected by a new Marriott data breach. Names, birthdates, telephone numbers, language preferences and loyalty account numbers were amongst the data that was stolen.||The breach was identified at the end of February, but records date back to mid-January 2020.|
|Slickwraps||Databases containing personal data, such names, home addresses and email addresses, were “mistakenly made public via an exploit” and “accessed by an unauthorized party”. Fortunately, the database didn’t contain passwords or personal financial data. Slickwraps disclosed the breach after many of their customers received an email from a hacker informing them that they had stolen their data.||The breach was disclosed in February 2020.|
|ExecuPharm||Various ExecuPharm servers were hit by a ransomware attack, which affected “select corporate and personnel information”. The attacked arrived via phishing emails that were sent to ExecuPharm employees.||The attack took place on March 13, 2020.|
|Nintendo||300,000 user accounts were breached by hackers exposing personal information such as the account owner’s name, email address, date-of-birth and country of residence.||The breach was first disclosed in March 2020, although Nintendo said the number of breached accounts “increased as a result of its continuing investigation”.|
|Zoom||Over 500,000 Zoom accounts are being sold on the dark web and hacker forums in what was said to be a “credential stuffing attack” – where the threat actors attempt to login to Zoom using accounts leaked in older data breaches.||The attack took place around April 2020.|
How Lepide Helps Companies Prevent Data Breaches
With the Lepide Data Security Platform, enterprises can get full visibility into the security states and changes being made to their permissions, configurations, and sensitive data. With pre-defined reports, real time alerts, and intelligent anomaly spotting, security teams can identify events and changes taking place that could indicate data breaches.
The Lepide Data Security Platform allows you to identify where your valuable data is, see who has access to it, analyze the behavior of your users, and audit security states and changes. If you’d like to see this in action, schedule a demo with one of our engineers or start a free trial today.