Apple, Meta, and Twitter have all disclosed cybersecurity attacks over the past 12 months.

Data breaches have been on the rise for a number of years, and sadly, this trend isn’t slowing down. The last year or so has been littered with thefts of sensitive information. Data breaches have affected companies and organizations of all shapes, sizes, and sectors, and they’re costing US businesses millions in damages.

The widely-covered T-mobile data breach that occurred last year, for instance, cost the company $350 million in 2022 – and that’s just in customer pay outs. This puts more onus than ever on businesses to secure their networks, ensure staff have strong passwords, and train employees to spot the telltale signs of phishing campaigns.

Below, we’ve compiled a list of significant, recent data breaches (and a couple of important data leaks) that have taken place since January 1, 2022, dated to the day they were first reported in the media.

January 2023
January 30
JD Sports Data Breach: As many as 10 million people may have had their personal information accessed by hackers after a data breach occurred at fashion retailer JD sports, which owns JD, Size?, Millets, Blacks, and Scotts. JD Sports CFO Neil Greenhalgh told the Guardian that the company is advising customers “to be vigilant about potential scam emails, calls and texts” while also “providing details on how to report these.”

January 20
T-Mobile Data Breach: T-Mobile has suffered another data breach, this time affecting around 37 million postpaid and prepaid customers who’ve all had their data accessed by hackers. The company claims that while it only discovered the issue on January 5th of this year, the intruders are thought to have been exfiltrating data from the company’s systems since late November 2022.

As discussed in the introduction to this article, this is not the first time that T-Mobile has fallen victim to a high-profile cyber attack impacting millions of customers. In the aftermath of last year’s attack, during which 76 million customers had their data compromised, the company pledged it would spend $150 million to upgrade its data security – but the recent attack raises serious questions over whether this has been well spent.

January 18
MailChimp Breach: Another data breach for MailChimp, just six months after its previous one. MailChimp claims that a threat actor was able to gain access to its systems through a social engineering attack, and was then able to access data attached to 133 MailChimp accounts. It’s a bad sign for the company, as the attack method is startling similar to last year’s breach, casting serious doubts on its security protocols.

PayPal Data Breach: A letter sent to PayPal customers on January 18, 2023, says that on December 20, 2022, “unauthorized parties” were able to access PayPal customer accounts using stolen login credentials.

PayPal goes on to say that the company has “no information” regarding the misuse of this personal information or “any unauthorized transactions” on customer accounts and that there isn’t any evidence that the customer credentials were stolen from PayPal’s systems.

January 6
Chick-fil-A Data Breach: fast food chain Chick-fil-A is investigating “suspicious activity” linked to a select number of customer accounts. The company has published information on what customers should do if they notice suspicious activity on their accounts, and advised such customers to remove any stored payment methods on the account.

January 4

Twitter Data Breach: Twitter users’ data was continuously bought and sold on the dark web during 2022, and it seems 2023 is going to be no different. According to recent reports, a bank of email addresses belonging to around 200 million Twitter users is being sold on the dark web right now for as little as $2. Even though the flaw that led to this leak was fixed in January 2022, the data is still being leaked by various threat actors.

December 2022
December 31
Slack Security Incident: Business communications platform Slack released a statement just before the new year regarding “suspicious activity” taking place on the company’s GitHub account.

“Upon investigation, we discovered that a limited number of Slack employee tokens were stolen and misused to gain access to our externally hosted GitHub repository. Our investigation also revealed that the threat actor downloaded private code repositories on December 27,” the company said. However, Slack confirmed that “no downloaded repositories contained customer data, means to access customer data, or Slack’s primary codebase”.

December 15
SevenRooms Data Breach: Threat actors on a hacking forum posted details of over 400GB of sensitive data stolen from the CRM platform’s servers. The information included files from big restaurant clients, promo codes, payment reports, and API keys. However, it seems that the servers that were breached did not store any customer payment details.

December 1
LastPass Data Breach: Password manager LastPass has told some customers that their information was accessed during a recent security breach. According to LastPass, however, no passwords were accessed by the intruder. This is not the first time LastPass has fallen victim to a breach of their systems this year – someone broke into their development environment in August, but again, no passwords were accessed.

November 2022
November 11
AirAsia Data Breach: AirAsia Group has, according to reports, suffered a ransomware attack orchestrated by “Daixin Team”. The threat group told DataBreaches.net that they obtained “the personal data of 5 million unique passengers and all employees.” This included name, date of birth, country of birth, location, and their “secret question” answer.

November 1
Dropbox data breach: Dropbox has fallen victim to a phishing attack, with 130 Github repositories copied and API credentials stolen after credentials were unwittingly handed over to the threat actor via a fake CricleCI login page.

However, Dropbox confirmed in a statement relating to the attack that “no one’s content, passwords or payment information was accessed” and that the issue was “quickly resolved”. Dropbox also said that they were in the process of adopting the “more phishing-resistant form” of multi-factor authentication technique, called “WebAuthn”.

October 2022
October 26
Medibank Data Breach: Medibank Private Ltd, currently the largest health insurance provider in Australia, said today that data pertaining to almost all of its customer base (nearly 4 million Australians) had been accessed by an unauthorized party. The attack caused Medibank’s stock price to slide 14%, the biggest one-day dip since the company was listed.

October 18
Vinomofo Data Breach: Australian wine dealer Vinomofo has confirmed it has suffered a cyber attack. Names, dates of birth, addresses, email addresses, phone numbers, and genders of the company’s almost 500,000 customers may have been exposed – although it is currently unclear how many have been affected.

October 17
MyDeal Data Breach: 2.2 million customers of Woolworths subsidiary MyDeal, an Australian retail marketplace, has been impacted by a data breach. According to reports, the company’s CRM system was compromised, with names, email addresses, telephone numbers, delivery addresses, and some dates of birth exposed during the breach.

October 15
Shein Data Breach: Fashion brand Shein’s parent company Zoetop has been fined $1.9 million for its handling of a data breach back in 2018, one which exposed the personal information of over 39 million customers that had made accounts with the clothing brand.

The New York Attorney General’s Office says Zoetop lied about the size of the breach, as the company initially said only 6.42 million accounts had been affected and didn’t confirm credit card information had been stolen when it in fact had.

October 11
Toyota Data Breach: In a message posted on the company’s website, the car manufacturer stated that almost 300,000 customers who had used its T-Connect telematics service had had their email addresses and customer control numbers compromised. The company assured customers that there was no danger of financial data such as credit card information, nor names or telephone numbers, having been breached.

In its statement, Toyota acknowledged that the T-Connect database had been compromised since July 2017, and that customers should be vigilant for phishing emails.

October 10
Singtel Data Breach: Singtel, the parent company of Optus, revealed that “the personal data of 129,000 customers and 23 businesses” was illegally obtained in a cyber-attack that happened two years ago. Data exposed includes “National Registration Identity care information, name, date of birth, mobile numbers, and addresses” of breach victims.

October 7
Possible Facebook Accounts Data Breach: Meta said that it has identified more than 400 malicious apps on Android and iOS app stores that target online users with the goal of stealing their Facebook login credentials. “These apps were listed on the Google Play Store and Apple’s App Store and disguised as photo editors, games, VPN services, business apps, and other utilities to trick people into downloading them,” the Tech giant said.

October 3
LAUSD Data Breach: Russian-speaking hacking group Vice Society has leaked 500GB of information from The Los Angeles Unified School District (LAUSD) after the US’s second-largest school district failed to pay an unspecified ransom by October 4th. The ransomware attack itself first made the headlines in early September when the attack disrupted email servers and computer systems under the district’s control.

September 2022
September 23
Optus Data Breach: Australian telecoms company Optus – which has 9.7 million subscribers – has suffered a “massive” data breach. According to reports, names, dates of birth, phone numbers, and email addresses may have been exposed, while a group of customers may have also had their physical addresses and documents like driving licenses and passport numbers accessed.

The attackers are thought to be a state-sponsored hacking group or some sort of criminal organization and breached the company’s firewall to get to the sensitive information. Australia’s Information Commissioner has been notified.

The Australian government has said Optus should pay for new passports for those who entrusted Optus with their data, and Prime Minister Antony Albanese has already suggested it may lead to “better national laws, after a decade of inaction, to manage the immense amount of data collected by companies about Australians – and clear consequences for when they do not manage it well.”

September 20
American Airlines Data Breach: The personal data of a “very small number” of American Airlines customers has been accessed by hackers after they broke into employee email accounts, the airline has said. Information accessed could have included customers’ date of birth, driver’s license, passport numbers, and even medical information, they added.

September 19
Kiwi Farms Data Breach: Notorious trolling and doxing website Kiwi Farms – known for its vicious harassment campaigns that target trans people and non-binary people – has been hacked. According to site owner Josh Moon, whose administrator account was accessed, all users should “assume your password for the Kiwi Farms has been stolen”, “assume your email has been leaked”, as well as “any IP you’ve used on your Kiwi Farms account in the last month”.

Revolut Data Breach: Revolut has suffered a cyberattack that facilitated an unauthorized third party accessing personal information pertaining to tens of thousands of the app’s clients. 50,150 customers have reportedly been impacted. The State Data Protection Inspectorate in Lithuania, where Revolut holds a banking license, said that email addresses, full names, postal addresses, phone numbers, limited payment card data, and account data were likely exposed.

September 18
Rockstar Data Breach: Games company Rockstar, the developer responsible for the Grand Theft Auto series, was victim of a hack which saw footage of its unreleased Grand Theft Auto VI game leaked by the hacker. In addition, the hacker also claims to have the game’s source code, and is purportedly trying to sell it. The breach is thought to have been caused through social engineering, with the hacker gaining access to an employee’s Slack account. The hacker also claims to be responsible for the Uber attack earlier in the month.

In a statement, Rockstar said: “We recently suffered a network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from our systems, including early development footage for the next Grand Theft Auto.”

September 15
Uber Data Breach: Uber’s computer network has been breached, with several engineering and comms systems taken offline as the company investigates how the hack took place. Dubbed a “total compromise” by one researcher, email, cloud storage, and code repositories have already been sent to security firms and The New York Times by the perpetrator.

Uber employees found out their systems had been breached after the hacker broke into a staff member’s slack account and sent out messages confirming they’d successfully compromised their network.

September 14
Fishpig Data breach: Ecommerce software developer Fishpig, which over 200,000 websites currently use, has informed customers that a distribution server breach has allowed threat actors to backdoor a number of customer systems. “We are quite used to seeing automated exploits of applications and perhaps that is how the attackers initially gained access to our system” lead developer Ben Tideswell said of the incident.

September 7
North Face Data Breach: roughly 200,000 North Face accounts have been compromised in a credential stuffing attack on the company’s website. These accounts included full names
purchase histories, billing addresses, shipping addresses, phone numbers, account holders’ genders, and XPLR Pass reward records. No credit card information is stored on site. All account passwords have been reset, and account holders have been advised to change their passwords on other sites where they have used the same password credentials.

September 6
IHG/Holiday Inn Data Breach: IHG released a statement saying they became aware of “unauthorized access” to its systems. The company is assessing the “nature, extent and impact of the incident”, with the full extent of the breach yet to be made clear.

September 3
TikTok Data Breach Rumour: Rumours started circulating that TikTok had been breached after a Twitter user claimed to have stolen the social media site’s internal backend source code. However, after inspecting the code, a number of security experts have dubbed the evidence “inconclusive”, including haveibeenpwned.com’s Troy Hunt. Users commenting on YCombinator’s Hacker News, on the other hand, suggested the data is from some sort of ecommerce application that integrates with TikTok.

Responding to a request for comment from Bloomberg UK, a spokesperson for TikTok said that the company’s “security team investigated this statement and determined that the code in question is completely unrelated to TikTok’s backend source code.”

September 2
Samsung Data Breach: Samsung announced that they’d fallen victim to a “cybersecurity incident” when an unauthorized party gained access to their systems in July. In August, they learned some personal information was impacted, including names, contact information, demographics, birth dates as well as product registration information. Samsung is contacting everyone whose data was compromised during the breach via email.

August 2022
August 29
Nelnet Servicing Data Breach: Personal information pertaining to 2.5 million people who took out student loans with the Oklahoma Student Loan Authority (OSLA) and/or EdFinancial has been exposed after threat actors breached Nelnet Servicing’s systems. The systems were compromised in June and the unauthorized party, who remained on the network until late July.

August 27
Facebook/Cambridge Analytica Data Breach Settlement: Meta agreed on this date to settle a lawsuit that alleged Facebook illegally shared data pertaining to its users with the UK analysis firm Cambridge Analytica. The data was subsequently used by political campaigns in the UK and US during 2016, a year which saw Donald Trump become president and Britain leave the EU via referendum.

August 25
DoorDash Data Breach: “We recently became aware that a third-party vendor was the target of a sophisticated phishing campaign and that certain personal information maintained by DoorDash was affected,” DoorDash said in a blog post.

The delivery service went on to explain that “the information accessed by the unauthorized party primarily included [the] name, email address, delivery address and phone number” of a number of DoorDash customers, whilst other customers had their “basic order information and partial payment card information (i.e., the card type and last four digits of the card number)” accessed.

LastPass Breach: The password manager disclosed to its customers that it was compromised by an “unauthorized party”. The company assured customers that this took place in its development environment and that no customer details are at risk. A September update confirmed that LastPass’s security measures prevented customer data from being breached, and the company reminded customers that they do not have access to or store users’ master passwords.

August 24
Plex Data Breach: Client-server media streaming platform Plex is enforcing a password reset on all of its user accounts after “suspicious activity” was detected on one of its databases. Reports suggest that usernames, emails, and encrypted passwords were accessed.

August 20
DESFA Data Breach: Greece’s largest natural gas distributor confirmed that a ransomware attack caused an IT system outage and some files were accessed. However, a quick response from the organization’s IT team – including deactivating online servers – meant that the damage caused by the threat was minimal.

August 10
Cisco Data Breach: Multi-national technology conglomerate Cisco confirmed that the Yanluowang ransomware gang had breached its corporate network after the group published data stolen during the breach online. Security experts have suggested the data is not of “great importance or sensitivity”, and that the threat actors may instead be looking for credibility.

August 4
Twilio Data Breach: Messaging behemoth Twilio confirmed on this date that data pertaining to 125 customers was accessed by hackers after they tricked company employees into handing over their login credentials by masquerading as IT department workers.

July 2022
July 26
Uber Data Breach Cover-Up: Although this data breach actually took place way back in 2016 and was first revealed in November 2017, it took Uber until July 2022 to finally admit it had covered up an enormous data breach that impacted 57 million users, and even paid $100,000 to the hackers just to ensure it wasn’t made public. The case will see Uber’s former chief security officer, Joe Sullivan, stand trial for the breach – the first instance of an executive being brought to the dock for charges related to a data breach.

July 22
Twitter Data Breach: The first reports that Twitter had suffered a data breach concerning phone numbers and email addresses attached to 5.4 million accounts started to hit the headlines on this date, with the company confirming in August that the breach was indeed genuine. The vulnerability that facilitated the breach was known by Twitter at the turn of the year and had been patched by January 13, 2022, so data theft must have happened within that short window.

July 19
Neopets Data Breach: On this date, a hacker going by the alias “TarTaX” put the source code and database for the popular game Neopet’s website up for sale on an online forum. The database contained account information for 69 million users, including names, email addresses, zip codes, genders, and dates of birth.

July 18
Cleartrip Data Breach: Travel booking company Cleartrip – which is massively popular in India and majority-owned by Walmart – confirmed its systems had been breached after hackers claimed to have posted its data on an invite-only dark web forum. The full extent of the data captured from the company’s internal servers is unknown.

July 13
Infinity Rehab and Avamere Health Services Data Breach: The Department of Health and Human Services was notified by Infinity Rehab that 183,254 patients had had their personal data stolen. At the same time, Avamere Health Services informed the HHS that 197,730 patients had suffered a similar fate. Information stolen included names, addresses, driver’s license information, and more. On August 16, Washington’s MultiCare revealed that 18,165 more patients were affected in the same breach.

July 12
Deakin University Data Breach: Australia’s Deakin University confirmed on this date that it was the target of a successful cyberattack that saw the personal information of 46,980 students stolen, including recent exam results. Around 10,000 of the university’s students received scam text messages shortly after the data breach occurred.

July 5
Marriot Data Breach: The Hotel group – which is no stranger to a data breach – confirmed its second high-profile data breach of recent years had taken place in June, after a hacking group tricked an employee and subsequently gained computer access. According to databreaches.net, the group claimed to be in possession 20 GB of data stolen from the BWI Airport Marriott’s server in Maryland. Marriot would be notifying 300-400 individuals regarding the breach.

June 2022
June 29
OpenSea Data Breach: NFT marketplace OpenSea – that lost $1.7 million of NFTs in February to phishers – suffered a data breach after an employee of Customer.io, the company’s email delivery vendor, “misused their employee access to download and share email addresses provided by OpenSea users… with an unauthorized external party”. The company said that anyone with an email account they shared with OpenSea should “assume they are affected”.

June 17
Flagstar Bank Data Breach: 1.5 million customers were reportedly affected in a data breach that was first noticed by the company on June 2, 2022. “We have no evidence that any of the information has been misused. Nevertheless, out of an abundance of caution, we want to make you aware of the incident” a letter from Flagstar bank to affected customers read.

June 14
Baptist Medical Center and Resolute Health Hospital Data Breach: The two health organizations – based in San Antonio and New Braunfels respectively – disclosed that a data breach had taken place between March 31 and April 24. Data lifted from its systems by an “unauthorized third party” included the social security numbers, insurance information, and full names of patients.

June 11
Choice Health Insurance Data Breach: On this date, Choice Health Insurance started to notify customers of a data breach caused by “human error” after it realized an unauthorized individual was offering to make data belonging to Choice Health available online. This had actually been publicly available since May 2022. The data dump consisted of 600MB of data with 2,141,006 files with labels such as “Agents” and “Contacts”.

June 7
Shields Health Care Group Data Breach: It was reported in early June that Massachusetts-based healthcare company Shields was the victim of a data breach that affected 2,000,000 people across the United States. The breach was first discovered on March 28, 2022, and information such as Social Security numbers, Patient IDs, home addresses, and information about medical treatments was stolen. A class action lawsuit was filed against the company shortly after.

May 2022
May 26
Verizon Data Breach: A threat actor got their hands on a database full of names, email addresses, and phone numbers of a large number of Verizon employees in this Verizon data breach. Vice/Motherboard confirmed these numbers were legitimate by ringing the numbers contained in the databases and confirming they currently (or used to) work at Verizon. According to Vice, the hacker was able to infiltrate the system after convincing an employee to give them remote access in a social engineering scam.

May 23
Texas Department of Transportation Data Breach: According to databreaches.net, personal records belonging to over 7,000 individuals had been acquired by someone who hacked the Texas Dept. for Transportation.

May 20
Alameda Health System Data Breach: Located in Oakland, California, Alameda Health System notified the Department of Health and Human Services that around 90,000 individuals had been affected by a data breach after suspicious activity was detected on some employee email accounts, which was later found to be an unauthorized third party.

May 17
National Registration Department of Malaysia Data Breach: A group of hackers claimed to hold the personal details of 22.5 million Malaysians stolen from myIDENTITI API, a database that lets government agencies like the National Registration Department access information about Malaysian citizens. The hackers were looking for $10,000 worth of Bitcoin for the data.

Cost Rican Government: In one of the most high-profile cyberattacks of the year, the Costa Rican government – which was forced to declare a state of emergency – was hacked by the Conti ransomware gang. Conti members breached the government’s systems, stole highly valuable data, and demanded $20 million in payment to avoid it being leaked. 90% of this data – amounting to around 670GB of the data – was posted to a leak site on May 20.

May 7
SuperVPN, GeckoVPN, and ChatVPN Data Breach: A breach involving a number of widely used VPN companies led to 21 million users having their information leaked on the dark web, Full names, usernames, country names, billing details, email addresses, and randomly generated passwords strings were among the information available. Unfortunately, this is not the first time supposedly privacy-enhancing VPNs have made the headlines for a data breach.

April 2022
April 4
Cash App Data Breach: A Cash App data breach affecting 8.2 million customers was confirmed by parent company Block on April 4, 2022 via a report to the US Securities and Exchange Commission. The breach had actually occurred way back in December 2021, with customer names and brokerage account numbers among the information taken.

Emma Sleep Data Breach: First reported on April 4, customer credit card information was skimmed using a “Magecart attack”. “This was a sophisticated, targeted cyber-attack on the checkout process on our website and personal information entered, including credit card data, may have been stolen” an email to customers read.

March 2022
March 30
Apple & Meta Data Breach: According to Bloomberg, in late March, two of the world’s largest tech companies were caught out by hackers pretending to be law enforcement officials. Apple and Meta provided the threat actors with customer addresses, phone numbers, and IP addresses in mid-2021. The hackers had already gained access to police systems to send out fraudulent demands for the data. Some of the hackers were thought to be members of the Lapsus$ hacking group, who reportedly stole the Galaxy source code from Samsung earlier in the month.

March 26
US Department of Education Data Breach: It was revealed that 820,000 students in New York had their data stolen in January 2022, with demographic data, academic information, and economic profiles all accessed. Chancellor David Banks blamed software company Illuminate Education for the incident.

March 24
Texas Department of Insurance Data Leak: The state agency confirmed on March 24 that it had become aware of a “data security event” in January 2022, which had been ongoing for around three years. “Types of information that may have been accessible”, the TDI said in a statement in March, included “names, addresses, dates of birth, phone numbers, parts or all of Social Security numbers, and information about injuries and workers’ compensation claims. 1.8 million Texans are thought to have been affected.

March 18
Morgan Stanley Client Data Breach: US investment bank Morgan Stanley disclosed that a number of clients had their accounts breached in a Vishing (voice phishing) attack in February 2022, in which the attacker claimed to be a representative of the bank in order to breach accounts and initiate payments to their own account. This was, however, not the fault of Morgan Stanley, who confirmed its systems “remained secure”.

February 2022
February 25
Nvidia Data Breach: Chipmaker Nvidia confirmed in late February that it was investigating a potential cyberattack, which was subsequently confirmed in early March. In the breach, information relating to more than 71,000 employees was leaked. Hacking group Lapsus$ claimed responsibility for the intrusion into Nvidia’s systems.

February 20
Credit Suisse Data Leak: Although this is technically a “data leak”, it was orchestrated by a whistleblower against the company’s wishes and one of the more significant exposures of customer data this year. Information relating to 18,000 Credit Suisse accounts was handed over to German publication Süddeutsche Zeitung, and showed the Swiss company had a number of high-profile criminals on their books. The incident kickstarted a fresh conversation about the immorality of Switzerland’s banking secrecy laws.

January 2022
January 20
Crypto.com Data Breach: On January 20, 2022, Crypto.com made the headlines after a data breach led to funds being lifted from 483 accounts. Roughly $30 million is thought to have been stolen, despite Crypto.com initially suggesting no customer funds had been lost.

January 19
Red Cross Data Breach: In January, it was reported that the data of more than 515,000 “extremely vulnerable” people, some of whom were fleeing from warzones, had been seized by hackers via a complex cyberattack. The data was lifted from at least 60 Red Cross and Red Crescent societies across the globe via a third-party company that the organization uses to store data.

January 6
Flexbooker Data Breach: On January 6, 2022, data breach tracking site HaveIBeenPwned.com revealed on Twitter that 3.7 million accounts had been breached in the month prior. Flexbooker only confirmed that customer names, phone numbers, and addresses were stolen, but HaveIBeenPwned.com said “partial credit card data” was also included. Interestingly, 69% of the accounts were already in the website’s database, presumably from previous breaches.

Data Breaches vs Data Leaks vs Cyberattacks
This article largely concerns data breaches. A data breach occurs when a threat actor breaks into (or breaches) a company, organization, or entity’s system and purposefully lifts sensitive, private, and/or personally identifiable data from that system. When this happened, companies are sometimes forced to pay ransoms, or their information is stolen ad posted online. According to one estimate, 5.9 billion accounts were targeted in data breaches last year.

This is different from a data leak, which is when sensitive data is unknowingly exposed to the public/members of the public, such as the Texas Department for Insurance leak mentioned above. The term “data leak” is often used to describe data that could, in theory, have been accessed by people it shouldn’t of, or data that fell into the hands of people via non-malicious means. A government employee accidentally sending someone an email with sensitive data is usually described as a leak, rather than a breach.

Although all data breaches fall under the umbrella of a “cyber attack“, cyber attacks are not limited to data breaches. Some cyber attacks have different motivations – such as slowing a website or service down or causing some other sort of other disruption. Not all cyberattacks lead to the exfiltration of data, but many do.

How Can I Protect My Organization From Cyber-Attacks?
Ensuring you take steps to protect your company from the sorts of cyber attacks that lead to financially fatal data breaches is one of the most crucial things you can do. It’s not just businesses that are at risk, however – schools and colleges are some of the most frequently targeted organizations that suffer huge financial losses.

Some companies and organizations – like Lincoln College – have had to shut down due to the fallout costs of a cyberattack. There has never been more of an onus on companies, colleges, and other types of organizations to protect themselves.

Unauthorized access to networks is often facilitated by weak business account credentials. So, whilst passwords are still in use, the best thing you can do is get your hands on a password manager for yourself and the rest of your staff team. This will allow you to create robust passwords that are sufficiently long and different for every account you hold. However, you’ll also need to use additional security measures, like 2-Factor Authentication, wherever possible, to create a second line of defense.

Another thing you must do is ensure your staff has sufficient training to spot suspicious emails and phishing campaigns. 70% of cyberattacks target business email accounts, so having staff that can recognize danger when it’s present is just as important as any software.

Source: https://tech.co/news/data-breaches-2022-so-far

People who use same passwords across many online sites are recommended to change to unique, secure passwords for each one. A strong password often has at least 12 characters, including symbols and alphanumeric characters.

Commenting on the incident, Ilia Kolochenko, founder of ImmuniWeb and a member of Europol Data Protection Experts Network, said: “It is at least surprising why MFA authentication is not enforced by default for such a sensitive service as PayPal.”

“Moreover, any unusual activity, such as login from an unknown location or new device should be rapidly reported to the user and the account may be temporarily suspended unless the user takes an action.

“Modern MFA technologies cost almost nothing to implement and should be enabled by default by financial service providers as a foundational security control. In the meantime, all users should urgently enable MFA everywhere, especially in view of the recent LastPass data breach.”

Source and more details: https://www.immuniweb.com/media/paypal-35000-customers-breached-in-credential-stuffing-attack.html

See also: Thousands Of PayPal Accounts Hacked—Is Yours One Of Them?

It’s time to start changing your passwords

Password manager giant LastPass has confirmed that cybercriminals stole its customers’ encrypted password vaults, which store its customers’ passwords and other secrets, in a data breach earlier this year.

In an updated blog post on its disclosure, LastPass CEO Karim Toubba said the intruders took a copy of a backup of customer vault data by using cloud storage keys stolen from a LastPass employee. The cache of customer password vaults is stored in a “proprietary binary format” that contains both unencrypted and encrypted vault data, but technical and security details of this proprietary format weren’t specified. The unencrypted data includes vault-stored web addresses. It’s not clear how recent the stolen backups are.

LastPass said customers’ password vaults are encrypted and can only be unlocked with the customers’ master password, which is only known to the customer. But the company warned that the cybercriminals behind the intrusion “may attempt to use brute force to guess your master password and decrypt the copies of vault data they took.”

Toubba said that the cybercriminals also took vast reams of customer data, including names, email addresses, phone numbers and some billing information.

Password managers are overwhelmingly a good thing to use for storing your passwords, which should all be long, complex and unique to each site or service. But security incidents like this are a reminder that not all password managers are created equal and can be attacked, or compromised, in different ways. Given that everyone’s threat model is different, no one person will have the same requirements as the other.

In a rare shituation (not a typo) like this — which we spelled out in our parsing of LastPass’s data breach notice — if a bad actor has access to customers’ encrypted password vaults, “all they would need is a victim’s master password.” An exposed or compromised password vault is only as strong as the encryption — and the password — used to scramble it.

The best thing you can do as a LastPass customer is to change your current LastPass master password to a new and unique password (or passphrase) that is written down and kept in a safe place. This means that your current LastPass vault is secured.

If you think that your LastPass password vault could be compromised — such as if your master password is weak or you’ve used it elsewhere — you should begin changing the passwords stored in your LastPass vault. Start with the most critical accounts, such as your email accounts, your cell phone plan account, your bank accounts and your social media accounts, and work your way down the priority list.

The good news is that any account protected with two-factor authentication will make it far more difficult for an attacker to access your accounts without that second factor, such as a phone pop-up or a texted or emailed code. That’s why it’s important to secure those second-factor accounts first, like your email accounts and cell phone plan accounts.

Sources: https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/

https://arstechnica.com/information-technology/2022/12/lastpass-says-hackers-have-obtained-vault-data-and-a-wealth-of-customer-info/

https://thehackernews.com/2022/12/lastpass-admits-to-severe-data-breach.html

https://techcrunch.com/2022/12/22/lastpass-customer-password-vaults-stolen/

A major breach of GoDaddy was disclosed on November 22nd affecting some 1.2 accounts, as well as “Managed hosting” accounts that are affiliated with GoDaddy through Media Temple, 123Reg, Domain Factory, Heart Internet, and Host Europe.

Apparently the hackers had access for over two months before the breach was discovered.

One of the biggest flaws exposed in this breach is that GoDaddy was storing your passwords as unencrypted plain text. That means the hackers didn’t even have to go through the trouble of decrypting to gain access to your account, FTP/SFTP, database, etc. GoDaddy is auto-resetting database and some other passwords, as well as SSL certificate keys which were potentially breached.

What Should I Do If I’m Affected?

If you use GoDaddy to host your WordPress site, here are a few (strong) recommendations to protect your website and your hosting account:

1. Reset your WordPress admin password.

2. Implement two-factor authentication for WordPress admin accounts.

3. Review your website’s security logs to see if there are unexpected logins to admin accounts.

4. Force a password change for all users at Contributor or higher level.

5. Log in to GoDaddy and change an FTP or SFTP or other passwords associated with your account or sites.

See details in the iThemes link below for details on all the above.

To be honest, we at ProtectYourWP and SustainableSources have never particularly liked GoDaddy, and though we reluctantly concede that they’ve gotten better in recent years we still suggest that you find a better hosting solution! So when they use the tagline in their advertising “It’s Go Time!”, we feel it’s more appropriate to say “It’s Go AWAY Time!”

Be on Guard for an Increase in Phishing Emails

There’s a good probability that various hackers/scammers will use the breached data to extend their attacks to other services by sending out phishing email.

Articles:

https://ithemes.com/blog/godaddy-hacked/

https://www.infosecurity-magazine.com/news/godaddy-announces-data-breach/

https://www.engadget.com/godaddy-wordpress-security-issue-1-2-million-users-150142622.html

https://techcrunch.com/2021/11/22/godaddy-breach-million-accounts/

https://therecord.media/godaddy-data-breach-impacts-1-2-million-wordpress-site-owners/

A security researcher discovered that a secret FBI’s terrorist watchlist was accidentally exposed on the internet for three weeks between July 19 and August 9, 2021.

A security researcher Bob Diachenko discovered a secret terrorist watchlist with 1.9 million records that were exposed on the internet for three weeks between July 19 and August 9, 2021.

In July, Diachenko discovered an unsecured Elasticsearch cluster containing 1.9 records of sensitive information on individuals, such as names, country citizenship, gender, date of birth, passport details, and no-fly status.

The list is extracted by the e FBI Terrorist Screening Center (TSC), a database used since 2003 by US feds and other agencies to track individuals who are “known or reasonably suspected of being involved in terrorist activities.”

 The copy of the TSC database was discovered by the expert on a Bahrainian IP address.

“The exposed Elasticsearch cluster contained 1.9 million records,” Diachenko wrote on LinkedIn. “I do not know how much of the full TSC Watchlist it stored, but it seems plausible that the entire list was exposed.“

“Each record in the watchlist contained some or all of the following info:

• Full name
• TSC watchlist ID
• Citizenship
• Gender
• Date of birth
• Passport number
• Country of issuance
• No-fly indicator”

At the time of this writing is not clear if the unsecured server was operated directly by the a U.S. government agency, a third-party, or in the worst case by a threat actor that obtained it.

Diachenko immediately reported his discovery to the U.S. Department of Homeland Security (DHS) and the instance of the database was taken down about three weeks later. It is a long period a circumstance that suggest that the server was not directly operated by the FBI.

“On July 19, 2021, The exposed server was indexed by search engines Censys and ZoomEye. I discovered the exposed data on the same day and reported it to the DHS.” continues the expert.

“The exposed server was taken down about three weeks later, on August 9, 2021. It’s not clear why it took so long, and I don’t know for sure whether any unauthorized parties accessed it.”

The exposed DA was also indexed by search engines Censys and ZoomEye, this means that other people could have had access to the secret list.

“It’s not clear why it took so long, and I don’t know for sure whether any unauthorized parties accessed it,” adds Diachenko.

This data leak could have a serious impact on the homeland security, the watchlist includes individual who represents a potential threat for the US even if they have yet to be charged of terrorism and other crimes.

“In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families.” says the researcher. “It could cause any number of personal and professional problems for innocent people whose names are included in the list,”

Cases, where people landed on the no-fly list for refusing to become an informant, aren’t unheard of.

Diachenko believes this leak could therefore have negative repercussions for such people and suspects.

“The TSC watchlist is highly controversial. The ACLU, for example, has for many years fought against the use of a secret government no-fly list without due process,” concludes the researcher

Source: https://securityaffairs.co/wordpress/121213/data-breach/fbi-terrorist-watchlist-leak.html