{"id":7958,"date":"2024-03-13T13:40:09","date_gmt":"2024-03-13T10:40:09","guid":{"rendered":"https:\/\/www.endpointprotector.com\/blog\/?p=7958"},"modified":"2024-03-19T13:37:21","modified_gmt":"2024-03-19T10:37:21","slug":"top-3-biggest-data-breaches-in-history","status":"publish","type":"post","link":"https:\/\/www.endpointprotector.com\/blog\/top-3-biggest-data-breaches-in-history\/","title":{"rendered":"Top 3 Biggest Data Breaches in History"},"content":{"rendered":"

The cost of a data breach for an enterprise can be enormous, both directly, as a result of legal and regulatory actions, and indirectly through loss of reputation and customers. Every CISO is most certainly aware of this, and so it comes as no surprise that large enterprises are the most likely to invest heavily in the resources and technologies intended to help them prevent such incidents. However, despite these huge investments, year after year we hear about yet another major data breach<\/a> affecting millions of people and costing billions of dollars.<\/p>\n

First, How Do Data Breaches Happen?<\/h2>\n

The main weaknesses that lead to data breaches are the complexity of enterprise systems and human errors that happen when designing, maintaining, and using those systems, throughout the entire system lifecycle. The bigger and the more complex the system, the harder it is to keep it continuously secure. And the bigger the enterprise, the more likely malicious actors will be highly interested in obtaining access to its sensitive data. One small weakness may cause a chain reaction \u2013 just like one slightly deformed fan blade in an airplane engine may detach and cut through all the other engines, ultimately killing everyone onboard<\/a>.<\/p>\n

Today\u2019s cybersecurity tools are thorough and effective. The scope of available security products covers every aspect of the enterprise\u2019s infrastructure: clouds, on-premises servers, networks, endpoints, IoT, and more. They provide testing, prevention, detection, and reaction. However, all of these tools need to be correctly implemented and maintained by humans, and even security experts make mistakes. Almost all major breaches in history, even if orchestrated by advanced attackers such as foreign espionage organizations, were ultimately caused by simple human error. Such errors were most often associated with insufficient security measures, a lack of due diligence with maintenance, or falling for advanced social engineering ploys.<\/p>\n

Here are some of the biggest corporate data breaches in history and the stories behind them.<\/p>\n

Yahoo! \u2013 Just one click was enough<\/h2>\n

Yahoo! appears on the list of biggest breaches several times, being the best example that a high-tech company is just as likely to be a victim of breaches as enterprises from any other sector \u2013 or maybe even more likely, because so many assets must be publicly exposed. The 2014 Yahoo! breach was not just their biggest, affecting up to 500 million people, but also the most interesting from a technological point of view. This is because the avalanche that led to the breach was started by one simple spear phishing email<\/a>, perfectly showing how one small human error can cost an enterprise billions.<\/p>\n

One wrong click by one employee allowed the attackers to assume a presence within the internal network, jump from an endpoint machine to the servers, and ultimately obtain access to the user database and its management tools. The most scary fact about this attack is that it could have happened to anyone \u2013 it\u2019s simply impossible to guarantee that every single employee in the organization is careful enough not to fall for a well-prepared social engineering attack. And, what\u2019s even worse, typical endpoint and email security software, such as antivirus and anti-phishing tools, is helpless with spear phishing attacks, which are prepared individually using custom tools and practically undetectable.<\/p>\n

While the scope of publicly available details about the attack is not enough to say whether good endpoint protection software could have prevented this attack, it is very likely that it could. Even if the victim clicked the spear-phishing link, for the attacker to gain access to the network, they would likely need to first access credentials or other sensitive information using remote control software. This is exactly where data loss prevention (DLP)<\/a> software such as Endpoint Protector would have most probably been able to detect improper access and raise an alarm, preventing from going forward with the attack.<\/p>\n

Equifax \u2013 A few small failures lead to a tragedy<\/h2>\n

The 2017 Equifax breach, which affected 143 million people, is yet another interesting story to learn from. This breach<\/a> proves how just a few small security weaknesses put together can allow a skilled attacker to escalate their presence in the target system to nearly absolute control. And if we could learn something specific from Equifax, it\u2019s that it\u2019s not just the end-users that make serious security mistakes \u2013 the entire chain of events was a result of security measure failures<\/a>.<\/p>\n

This attack, most probably engineered by Chinese espionage forces, started with a failure of the security personnel responsible for server software patching. The consumer complaint web portal was running a version of a web application server with a well-known vulnerability \u2013 all it would take to fix it would be to apply the recommended security patches, and all it would take to discover it was a simple security scanner.<\/p>\n

The next failure was a lack of system segmentation and storing system access passwords in simple text files. This type of practice is, unfortunately, very common among many server administrators, who wrongly assume that only legitimate users can get access to any of their servers and therefore make their lives easier by storing system access credentials in insecure files. This type of practice is luckily easily detectable using DLP software<\/a> \u2013 user access to files containing sensitive, easily recognizable patterns such as usernames and passwords stored in clear text, would not just be prevented but also immediately raise an improper access alarm.<\/p>\n

Last but not least: once the attackers accessed the sensitive data, they were able to extricate it for months from Equifax systems over regular network connections simply because one of the internal security tools did not have an updated security certificate. All in all, all three stages of the attack were possible due to the incompetence of well-trained technical staff, which raises the question: if we can\u2019t trust the \u201csecurity guys\u201d to handle security well, whom can we trust?<\/p>\n

Capital One \u2013 Not just foreign spies<\/h2>\n

While the two previously described data breaches were orchestrated by foreign powers, which hired well-prepared and well-financed teams of specialists, this is, surprisingly, not the most common scenario with major data breaches. Quite a few of the biggest breaches were caused by amateurs or exposed by white-hat security experts (the \u201cgood guys\u201d) before anyone would be able to take advantage of the sensitive information. For example, for quite a while, one of the most common mechanics behind security breaches was publicly accessible Elasticsearch databases \u2013 anyone could simply point to the insecure address and access all the data using a standard login and password.<\/p>\n

The Capital One hack was a different, yet common scenario, where a person without truly malicious intent balanced on the edge of the law to impress their peers. This was exactly the case of Paige Thompson, who caused a $250 million data breach by simply downloading sensitive data to her private computer, clearly with no intent of selling it on the black market but only to show off to the hacking community.<\/p>\n

Why Paige Thompson deserves some attention is that she was almost a textbook model of someone who caused major harm due to a combination of circumstances. First of all, she represented an internal threat, being an ex-Amazon employee, and Capital One was using Amazon services to store their sensitive data. Second of all, Paige was suffering from mental health problems and gender identity struggles, making her more likely to seek peer validation and make bad judgments. As a result, her actions were rash and emotional, but luckily for her did not cause her to spend her life in prison for this mistake<\/a>.<\/p>\n

From a technical standpoint, Capital One was no different than most other major hacks \u2013 it was a multi-stage process caused by several security weaknesses and misconfigurations<\/a>. First, Thompson took advantage of a server-side request forgery weakness in Capital One\u2019s web application to be able to access the Amazon cloud infrastructure behind that web application, which could have been prevented if Capital One used web security scanning. Then, Thompson was able to obtain access to a role with excessive privileges, which allowed her to sync the S3 buckets, effectively downloading sensitive data to her computer. While the application was behind a web application firewall, this firewall was also misconfigured with insufficient logging or excessive permissions, allowing for this process to go unnoticed.<\/p>\n

The Capital One breach exposed the dangers of internal threats<\/a> \u2013 disgruntled employees or ex-employees are more likely to either make serious mistakes or even act inappropriately towards the company, potentially becoming the first step in the data breach. It also showed that cloud infrastructure, even if hosted by such a renowned company as Amazon, is just as likely to have security misconfigurations and that even administrative access privileges should be well-controlled and monitored.<\/p>\n

Is there any hope to prevent data breaches?<\/h2>\n

Your best hope to help prevent data breaches in your organization is to learn from the mistakes made by others. Just these three major breaches show a plethora of typical errors such as excessive trust in security personnel and the lack of coverage of certain cybersecurity attack surfaces. No single all-in-one security solution from even the most renowned security company will cover every base that you need to cover. Only a well-designed security program can help you make sure that you don\u2019t have holes such as the lack of DLP software to protect your endpoints<\/a>.<\/p>\n

The best approach to avoid data breaches is, therefore, to follow the zero trust conundrum \u2013 and not just zero trust networking or zero trust applications, but also zero trust security programs. While your security personnel are most likely doing their best to ensure that a breach doesn\u2019t happen, they\u2019re only human and will also make mistakes. Therefore, monitoring and double-checking their activities will not be a sign that you don\u2019t trust them enough, but should rather be perceived as a will to make the right investments in not just your security but also the security of your customers and partners.<\/p>\n","protected":false},"excerpt":{"rendered":"

The cost of a data breach for an enterprise can be enormous, both directly, as a result of legal and regulatory actions, and indirectly through loss of reputation and customers. Every CISO is most certainly aware of this, and so it comes as no surprise that large enterprises are the most likely to invest heavily … <\/p>\n

Continue reading “Top 3 Biggest Data Breaches in History”<\/span><\/a><\/p>\n","protected":false},"author":18,"featured_media":7969,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-7958","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-loss-prevention","entry"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts\/7958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/comments?post=7958"}],"version-history":[{"count":25,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts\/7958\/revisions"}],"predecessor-version":[{"id":7988,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts\/7958\/revisions\/7988"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/media\/7969"}],"wp:attachment":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/media?parent=7958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/categories?post=7958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/tags?post=7958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}