Data breach is an information security incident that publicly exposes personal information

Data is evolving to be one of the most valuable assets in the digital world. The tech giants that monopolize data are the most powerful companies in the world. However, despite the overwhelming value of data controlled by these entities, they are often becoming vulnerable to data breach epidemic.

A data breach is an information security incident in which personal information is publicly exposed or accused without authorisation. When big companies like Facebook and Yahoo has gotten widespread attention for the impact of a data breach, small entities are no escape. Data breaches can affect businesses of all sizes in a variety of ways. They are difficult to identify, costly to address and cause reputational damage that some businesses never recover from it. However, the only thing that companies can do at such situations is to mitigate the effects of a breach to implement a thorough risk management practice for the detection, containment and communication in the wake of a data breach.

Here is the list of largest and well-known data breaches in history

Yahoo Data Breach

Date: October 2017

Impact: 3 billion accounts

Yahoo experienced the largest data breach in history in 2013. But it took another three to four years to discover the mishap. Andrew Komarov, the Chief Intelligence Officer of the cybersecurity firm InfoArmor found out about the data breach when he was helping the company in response to another attack in 2016. While trying to take down the stolen data, he unravelled hints of 2013 breach. Andrew noticed a dark web seller offering close to US$300,000 for a list of more than one billion Yahoo accounts in August 2015.

Yahoo faced a hot in its revenue when it went public with the data breach. The company notified its users to reset password and renew security questions. News of the breach lowered Yahoo's value by US$350 million and the stock price fell by 3%.

The security breach led Yahoo to long term consequences. Further, the company ran into various regulatory and civil litigants because it failed to disclose the breach in a timely manner. It is anticipated that many of Yahoo's post-breach injuries could have been avoided had it investigated and disclosed the breach sooner.

First American Financial Corporation Data Breach

Date: May 2019

Impact: 885 million users

Brian Krebs reported the massive data breach of financial records from First American Financial Corporation in 2019. The breach leakage digitized documents that go back to 2013. Some of the most critical info stolen during the breach were bank account numbers, bank statements, mortgage and tax records, social security numbers, wire transaction receipts and drivers license images.

The breach was stemmed from an authentication error. No authentication was required to access documents, making them available to anyone with a web browser. Any person with the URL can access the information and with a change of single-digit, it was easy to find other documents with similar URLs.

First American experienced a common web designer error called Insecure Direct Object Reference (IDOR). Basically, a web page with sensitive information is created with the intent that it will only be viewed by a specific party. However, the table turned as there is no way to identify the person viewing it. Anyone who types the link can directly access the browser. Once a single link was discovered, cybercriminals utilized Advanced Persistent Bots (APBs) to collect and index the remaining documents.

The incident showed that organisations can't rely on unique URLs to safeguard information. Instead, documents should be protected with passwords and multi-factor authentication.

Facebook Data Breach

Date: September 2019

Impact: 400 million users

Facebook has reported a number of security breaches in the past. However, the data breach that the company reported in 2019 was massive. Facebook disclosed that millions of Instagram passwords had been stored online in plain text. Since then, other issues like a technical flaw that allowed children to chat with strangers online, unbeknownst to their parents.

Then in September 2019, news emerged of a data leak that exposed the phone numbers of around 400 million Facebook users. The database included records across multiple geographic locations, including 133 million Facebook users in the United States, 18 million in the UK and more than 50 million in Vietnam. The database in question was found to be unprotected by password or any kind of encryption. Anyone searching the web can find and access the information.

Marriott International Data Breach

Date: September 2018

Impact: 500 million guest records

On September 8, 2018, a security tool flagged a suspicious attempt to access a guest reservation database for Marriott's Starwood brands. When the international corporation commenced an investigation, it was discovered that the Starwood network had been compromised in 2014 when it was still a separate entity before merging with Marriott.

Marriott purchased Starwood in 2016 but failed to integrate the company with its reservation system. Starwood was still using its previous IT infrastructure that led to an attack. The record of 500 million guests was totally wiped out from the Starwood systems by the hacker. They used Trojan software to access the account.

FriendFinder Networks Data Breach

Date: October 2016

Impact: 400 million accounts

FriendFinder Networks Inc experienced one of the largest data breaches in history in 2016. The company compromised 400 million accounts with the majority of them coming from AdultFriendFinder.com. Each database involved in the breach contained usernames, passwords, and email addresses that were stored in plain text.