5 of the Biggest Data Breaches So Far in 2019: What Happened?

When it comes to data breaches, 2019 already looks ominous. More than one billion records were exposed in the first quarter of the year alone, with a greater number of individual incidents reported than in any previous year. We’re seeing more stolen credentials for sale on the Dark Web than at any time in history—along with consumers’ personal and financial data, health records, IP addresses, birth dates, and more.

It’s clear that cyber criminals are as innovative and tireless as ever. Let’s take a closer look at some of the biggest and most serious data breaches that have taken place so far this year.

What went wrong, and what lessons can business leaders learn from these incidents?

1.) Facebook

In late March of 2019, cybersecurity researchers shared that they’d found two large repositories of Facebook user data that were publicly accessible on Amazon cloud servers. The data included passwords, names, comments, and records of likes, which affected more than 540 million user accounts. The data had been improperly shared by two third-party app developers, one of which had been storing information inappropriately since 2014.

This wasn’t the first breach the social media giant suffered in 2019. While still under federal investigation for last year’s Cambridge Analytica scandal, Facebook was reported to have been storing user account passwords in plain text on internal servers, where they were legible—and searchable—by employees. Less than a month after the March incident, an additional 1.5 million users were impacted by improper email contact harvesting practices.

2.) Fortnite

More than 80 million players used this massively popular online gaming platform every month during 2018. Hackers were able to take advantage of an unpatched vulnerability in the game’s login system to impersonate other players, make charges to on-file credit cards, access players’ contact lists, and eavesdrop on voice chat conversations between players. Fortnite’s maker, Epic Games, has not commented on the scope of the breach, but there are as many as 200 million registered user accounts in Fortnite. What’s most troubling is that a majority of Fortnite’s users—and thus the breach’s victims—were children.

3.) Quest Diagnostics

Quest Diagnostics has one of the largest networks of clinical testing laboratories in the United States. On June 3, 2019, Quest announced that sensitive personal data belonging to approximately 12 million of their customers has been exposed. The information comprised bank account and payment details, addresses and personal contact information. It may also have included social security numbers and protected medical information such as test results.

This breach took place due to a vulnerability in the systems of a third-party vendor providing billing and collections services to Quest. Threat actors gained access to the vendor’s website and executed a “man-in-the-middle” attack, through which they harvested the payment and personal information visitors entered. The breached data has been described as a “treasure chest” since it contained three of the most valuable types of protected information—personally identifiable information (PII), credit card data, and health information.

4.) Canva

The Sydney-based technology startup offering a popular online graphic design platform disclosed in late May that data from approximately 139 million of their users had been exposed in a hack. The perpetrator, known by the pseudonym GnosticPlayers, has put data stolen from 932 million user profiles at 44 companies across the world up for sale on the Dark Web since February 2019. The information exposed in the Canva breach included customer names, usernames, and locations. User passwords were also stored within the breached database, but all the passwords were strongly encrypted.

5.) Federal Emergency Management Agency (FEMA)

Personal data from more than 2.3 million victims of disasters such as hurricanes Irma and Maria was inadvertently shared with a third-party contractor who should not have had access to that information. FEMA claims the contractor voluntarily worked with them to scrub the data from all systems as soon as the erroneous release was discovered, and no further disclosures were made. If that’s not the case, it may be that the federal agency tasked with providing primary assistance, including help obtaining food and shelter, to families affected by large-scale natural disasters instead set them up to become identity theft victims.

Takeaway

What can you learn from these stories? Their most prominent overarching theme is simple: data breaches continue to affect organizations large and small, in all sectors and industries, in all countries of the world. Educational institutions are targeted, as are government agencies and municipalities—just about anyone, anywhere, who holds any type of data, is at risk.

To protect your organization, it is essential to shift your mindset and adopt a zero trust security architecture. By assuming everything is malicious until it’s verified as safe will prevent your organization from damage. By layering solutions including Advanced Endpoint Protection, Endpoint Detection and Response and Network Security Solutions, organizations can gain full visibility to endpoint and network activity to prevent breaches like those above.

Read this ebook to learn how to implement a zero trust security architecture to prevent breaches. 

ITIL

IT Inventory Software