Biggest Data Breaches and What We Can Learn from Them

Reason – Poor security, ignoring failed security tests, continued unresponsiveness after the data breach was discovered

Year – 2019

Records Affected – 885 Million

Cost – The cost may be up to $1,000 per violation, setting the tab at $885 billion

Error – Insecure Direct Object Reference (IDOR)

What happened?

The First American Financial Corp. leaked digitised records of bank account numbers, tax records, Social Security numbers, images of drivers' licenses and IDs, and mortgage records. A truly vast amount of data was affected, going as far back as 2003.

This could not have been a surprise, given that this particular vulnerability was discovered as early as 2018, during security testing. So, what went wrong and why was it allowed to continue until the breach became public, published in industry journals? The case is so recent, that a lot of it is still in courts and responsibility is still to be determined. First American is likely to fight any court decision, as any acceptance of responsibility will cost them dearly.

What happened is the Insecure Direct Object Reference (IDOR) error – it's a common error, showing up regularly on penetration test reports, and it means that a link created to be seen by specifically authorised persons is able to be seen by anyone who has it. There is no password and the person trying to access the data has to figure out the pattern for all other sensitive files stored in the system. In the case of First American, there is no way of knowing who saw the data and how many files were compromised. It might take years to learn.

Lessons learned

Insecure Direct Object Reference (IDOR) errors are not uncommon, and has to be fixed when found. Otherwise, stockpiles of sensitive data might just be sitting out in the open, waiting to be harvested by bots, hackers, and just about anyone who's loose morals and technical know-how make them take interest in the profit that stolen data might bring.

Reason – Poorly kept passwords, old safety protocols, and algorithms, poor data protection policy

Year – 2016

Records Affected – 412.2 Million

Cost – Unknown

Error – Weak SHA-1 hashtag algorithm password protection (or no protection at all)

What happened?

FriendFinder Networks Inc. had 6 databases that were breached – to the horror of the adult conglomerate's users who hoped to remain anonymous. As usual, the leak was first publicised not in a private email to users, but by a researcher on Twitter – with screenshots to prove a data breach.

The surprising thing was that a large portion of the data collected from FriendFinder Networks was clearly marked for deletion, with the records having an "rm_" next to them (removal marker) or email addresses clearly meant for deletion, like email.address@address.com@deleted1.com. This means that there was no "clean up" done in these servers, and some files that should have been long gone (and most importantly, users thought long gone) were still sitting in dusty corners of the servers, like overflowing wastebaskets left by a careless housekeeper. Overall, this particular wastebasket had over 15 million deleted accounts as well as logins for sites long sold to other people (Penthouse.com).

The news of this breach was probably extra worrisome for people whose email addresses ended with .gov (5,650) and .mil (78,301).

What sealed their fate was weak password protection. Some user passwords weren't protected at all and stored in plaintext, or hashed using SHA1 which was already known to be very weak.

Lessons learned

While some data breaches may come as a surprise, keeping your records clean might prepare for the unexpected. If you're in charge of millions of people's sensitive data, it's also a good idea to use the newest and most secure technology to prevent data breaches. Good record-keeping (including deleting data) is also a core component of GDPR compliance. Organisations should treat users and their data with the respect they deserve – after all, they trust you to keep their information secure, especially in a sensitive niche like dating and adult webcam access!

Reason – User data was too easily accessible on public profiles, leading to the possibility of being collected by bots

Year – 2019

Records Affected – 267 million

Cost – Unknown

Error – Security hole in Facebook's API

What happened?

This is another example of data sitting out for weeks before the data breach is discovered. Meanwhile, the user IDs, phone numbers, and names of hundreds of millions of users were left out in the open. It meant anyone could use it for further attacks, and scams. What's worse, this data was posted on a hacker forum free for the taking. Facebook looked into the matter, and decided that this breach isn't in fact a breach at all – but a mass scraping action of data that was publicly available before security measures were put into place.

Lessons learned

While we trust in large companies like Facebook to guard our personal data, we must also remember that data breaches might come as an organised mass attack on data that we make public on such social platforms. Always read the privacy notice and what you're agreeing to share when you sign up for a platform like Facebook, Linked In, or Twitter. Who is going to have access to your data? Who is going to be authorised to use it? While your phone number, name, or email might not be of significance to your uncle Jerry when he's looking at your profile, and you may post it so people can contact you – it can do a whole lot of harm when it falls into the hands of those who know how to use personal information against you.

Let's remember that the election-swaying Cambridge Analytica scandal wasn't caused by a data breach – if it were, it would have been the greatest data breach in history. Instead, it was caused by millions of people unknowingly yet legally giving their personal information to people with malicious intent.

Reason – Marriott International failed to check basic cyber safety after purchasing another hotel brand – and failed to discover an ongoing problem

Year – 2019

Records Affected – 339 million

Cost – Fined $23.98 million in the UK

Error – Security hole in Facebook's API

What happened?

Hotel guest names, contact information, and even passport details might have gotten out – and what's worse – have been out over a period of four years. The first cyber attacks on Marriott happened in 2014 and were only discovered in 2018. The first target was the Starwood Hotels Group, and you can say that Marriott acquired the problem when they acquired Starwood in 2016. That being said, they had plenty of time to do a deep safety audit – and by not doing enough to protect their guests.

The biggest problem was that the cyber attacks were a known problem – but Marriott never checked it out enough. The breach of customer data at Marriott International is one of the largest in the hotel industry. Hotels are especially sensitive businesses to run when it comes to data protection because they often gather large amounts of very personal details about their clients.

Lessons learned

These days, when becoming a partner or an owner of an existing business, you have to check out every part of it – and cyber security due diligence is just as important as checking the physical assets, bank accounts, and tax records of your new venture.