A data breach occurs when sensitive or confidential information is accessed, stolen or exposed without authorization. Such incidents can lead to identity theft, financial losses, privacy violations and reputational damage.
- Common causes include software vulnerabilities and weak security controls.
- Misconfigured databases and compromised credentials are also frequent causes.
Aadhaar Data Exposure
In 2018, reports claimed that Aadhaar-related data on about 1.1 billion people, including phone numbers and dates of birth, was at risk. The source and scope of the exposure remained disputed.
- Organizations handling identity data should tighten access controls and review permissions regularly.
- Reported vulnerabilities should be properly investigated.
Marriott-Starwood Data Breach
In 2018, Marriott disclosed that attackers had accessed the Starwood reservation database since 2014, potentially affecting up to 500 million guests. Exposed data included names, contact details, passport numbers and some payment card details.
- Marriott set up a dedicated support website and call center.
- The Starwood database was phased out by the end of 2018.
Exactis Data Exposure
In 2018, a publicly accessible Exactis database with about 340 million records was discovered. It contained names, phone numbers, addresses and personal characteristics.
- Databases should require authentication before anyone can access them.
- Regular security audits help find exposed systems.
Under Armour (MyFitnessPal) Data Breach
In 2018, a breach of MyFitnessPal affected about 150 million accounts. Exposed data included usernames, email addresses and hashed passwords. Payment card data was not reported as stolen.
- Users were advised to change their passwords.
- Users were told not to reuse passwords across platforms.
Quora Data Breach
In December 2018, Quora reported unauthorized access affecting about 100 million users. The compromised data included names, email addresses, hashed passwords and some account-related data.
- Quora investigated the incident.
- Potentially affected users were logged out and passwords were invalidated where necessary.
MyHeritage Data Breach
In 2018, MyHeritage reported that email addresses and hashed passwords for about 92 million accounts had been exposed. The data came from a file found outside the company's systems.
- Unique passwords reduce the risk of account takeover.
- Multi-factor authentication adds a second layer of protection.
Facebook Data Breach
In October 2018, attackers exploited a flaw in Facebook's "View As" feature to steal access tokens that could be used to take over accounts. About 50 million accounts were considered at risk and about 90 million users were logged out as a precaution.
- Facebook fixed the vulnerability and reset access tokens for affected accounts.
- The company investigated the scope of the incident.
Elasticsearch Data Exposure
Misconfigured Elasticsearch clusters have been linked to incidents where large amounts of data became publicly accessible. One reported exposure involved about 73 GB of data.
- Enable authentication and restrict public access to clusters.
- Fix configuration errors and review settings before going online.
Newegg Data Breach
In September 2018, attackers injected malicious JavaScript into Newegg's checkout page to steal payment information. This technique, known as web skimming, targets website code rather than the central database.
- Malicious scripts must be removed and checkout pages monitored for unauthorized changes.
- Script integrity checks and Content Security Policy help block unauthorized scripts.
Panera Bread Data Exposure
In 2018, a website vulnerability exposed Panera Bread customer data, including names, email addresses and phone numbers. Reports differed significantly on the number of affected records.
- Patch the vulnerability and restrict access to customer records.
- Run regular application security tests.
Equifax Data Breach
In 2017, Equifax disclosed a breach affecting about 143 million people. Exposed data included names, dates of birth, addresses, Social Security numbers and some credit card details. Attackers exploited a web application vulnerability that had not been adequately addressed.
- Equifax faced regulatory investigations and legal action.
- The case shows why security updates must be applied promptly.
Yahoo Data Breach
Yahoo disclosed a 2014 breach affecting about 500 million accounts. It later revealed that a separate 2013 breach had affected all three billion accounts that existed at the time.
- Certain account security credentials were invalidated.
- Investigations and legal consequences followed.
Target Data Breach
In 2013, attackers compromised Target's payment systems during the holiday shopping season, exposing payment card data for about 40 million customers.
- Target worked with payment card companies and investigators.
- The breach drew attention to payment-system monitoring and third-party access controls.
Myspace Data Breach
In 2016, data from about 360 million Myspace accounts, including usernames and passwords, appeared for sale online. Old databases stay risky for years, especially when users reuse credentials.
- Services should use modern password hashing.
- Stronger authentication reduces the impact of stolen credentials.
AOL Search Data Exposure
In 2006, AOL released about 20 million search queries from around 650,000 users for research. Direct identifiers were removed, but some users could still be identified from their search patterns.
- Assess re-identification risk before publishing datasets.
- Remove or generalize sensitive information and conduct privacy assessments before sharing user data.
