Top Data Breaches Of 2017

Recently, the company Risk Based Security found that 2017 was a big year for data breaches. While it focused on statistics from the year, the InfoSec Institute gathered together a list of its biggest data breaches of the year. And because it’s more fun to keep readers in suspense, we will start at number 10. If you are one of those people who hates surprises, just jump to the bottom. However, (spoiler alert) number one probably won’t surprise you. So take some time to peruse the others that didn’t make such big headlines. Maybe some of them will be interesting to you too.

10. The National Security Agency (NSA) – Yes, the top security organization in the United States is in the top ten for 2017. And not only is it in this year’s list, but it has made the top ten for the last five years. Featured in 2017 was the “Red Disk” incident in which a virtual disk with that code name was found on an unsecured web server. On that sever was a bunch of highly confidential information. To date, it isn’t known who made that error or perhaps put it there intentionally.

• Advice to victims: This one is more an FYI. There isn’t a lot any one person can do at this time other than shake our head in disbelief.

9. Cloudflare – This content delivery network left client information unencrypted and open to the Internet. While this wasn’t an intrusion, personal information of users of companies such as FitBit, Uber, and OKCupid was exposed.

• Advice to victims: Watch out for targeted phishing emails. Don’t click links or attachments that are unexpected and/or from those that are unknown to you.

8. Dun & Bradstreet – This data analytics company found itself the victim of a breach that is making researchers scratch their collective heads. A cyber researcher received a link to a large file (52GB) that contained millions of records—33.7 million to be more precise—that included unique email addresses and other information that it retrieved from a NetProspex database. The who, what, why is still TBD.

• Advice to victims: Watch out for targeted phishing emails. Don’t click links or attachments that are unexpected and/or from those that are unknown to you.

7. The Internal Revenue Service (IRS) – In trying to help students complete their federal student financial aid forms, the IRS created a handy Data Retrieval Tool. This allowed the students to retrieve data from their parents’ tax forms and auto-fill it into the financial aid forms. Unfortunately, there was a flaw in this tool that allowed thieves to get all auto-filled information. More unfortunately, even after this bug was discovered in October of 2016, the IRS allowed the tool to remain online until March of last year. The IRS estimates that 8,000 tax forms were fraudulently filed and around $30 million in refunds was stolen.

• Advice to victims: File income taxes early. The sooner you file, the less likely a thief will file on your behalf. Also, be sure to check your credit reports regularly and report suspicious activity to the bureaus for resolution.

6. Gmail – Yes, the technology giant, Google was not left out. Its Gmail service was infiltrated by a worm that got into users’ inboxes and sent mail to their users, making the recipients think it was from their actual contacts. Those emails included a link to a legitimate Google document, which then re-directed to a fake portal where information was entered by the unsuspecting victims and put into the hands of the thieves. Fortunately, it affected “only” 0.1% of Google’s users. However, that’s still one million people and most would agree no small number.

• Advice to victims: Watch out for targeted phishing emails. Don’t click links or attachments that are unexpected and/or from those that are unknown to you.

5. DocuSign – If you have purchased or refinanced a home, you may be familiar with this electronic document signature service. Last year, hackers got into one of the company’s “non-core” sections of its database. More than 100 million email addresses were likely stolen.

• Advice to victims: Watch out for targeted phishing emails. Don’t click links or attachments that are unexpected and/or from those that are unknown to you.

4. World Wrestling Entertainment (WWE) – The security firm Kromtech let the WWE network know that it found three million accounts exposed. Information included names, addresses, and information on children. The blame went to a misconfigured Amazon server.

• Advice to victims: Watch out for targeted phishing emails. Don’t click links or attachments that are unexpected and/or from those that are unknown to you.

3. Deloitte – The breach of one of the top accountancy firms worldwide exposed information of nearly 350 clients. The information included details on top-level executives, which may have been used in business email compromise (BEC) scams. The perpetrators got through using an administrator account that did not have multi-factor authentication (MFA) enabled.

• Advice to victims: Watch out for targeted phishing emails. Don’t click links or attachments that are unexpected and/or from those that are unknown to you.

• Advice to organizations: Enable MFA on all administrator level accounts. In addition, implement access controls for employees, staff, and third parties that have access to your network.

• Advice to employees: Verify requests from top-level executives that may seem a little misplaced. Always verify by calling or by making an in-person visit to the requestor before fulfilling these requests.

2. Verizon – Personal data of 14 million people was exposed when left on an unsecured Amazon server that was managed by a third party.

• Advice to victims: Watch out for targeted phishing emails and text messages. Don’t click links or attachments that are unexpected and/or from those that are unknown to you. Change PINs as well, if you haven’t done so already.

• Advice to organizations: Vet your third party vendors and service providers thoroughly. Make sure they have your data security in mind.

1. Equifax – This one is no surprise. Nearly half the residents of the U.S. were victims when a vulnerability in an open source Apache server was exploited.

• Advice to victims: File income taxes early. The sooner you file, the less likely a thief will file on your behalf. In addition, if you do not need anyone to access your credit, consider freezing it. This will prevent anyone (including you) from accessing your reports and opening fake accounts. If that isn’t reasonable, take advantage of the offered credit monitoring service and be sure to check credit reports from all three major bureaus at least yearly. They can be retrieved at no charge at annualcreditreport.com.