Top 10 Breaches and Leaky Server Screw Ups of 2019
From massive credential spills on the Dark Web and hacked data to card-skimming and rich profiles exposed by way of cloud misconfigurations, 2019 was a notable year for data breaches. Big names like Capital One, Macy’s and Sprint were impacted, as was the entire country of Ecuador and supply-chain companies like the American Medical Collection Agency. Here are our Top 10 data leak moments of the year.
Collections 1-4 Spill Millions of Credentials on the Dark Web
The year started out with a bang when a huge trove of data – containing 773 million unique email addresses and passwords – was discovered on a popular underground hacking forum. The credential spill was dubbed “Collection #1” and totaled 87GB of data, with records culled from breaches that occurred as far back as 2010, including the well-known compromise of Yahoo. It was one of the largest jackpots ever seen when it comes to account-compromise efforts. Collections 2-4 soon followed, and ultimately more than 840 million account records from 38 companies appeared for sale on the Dark Web in February.
AMCA Supply-Chain Breach Impacts 20.1 Million
A hack of the American Medical Collection Agency (AMCA), a third-party bill collection vendor, impacted 20.1 million patients over the summer, exposing personally identifiable information such as names, addresses and dates of birth, and also payment data. Three clinical laboratories offering blood tests and the like that relied on AMCA to process a portion of their consumer billing were hit: 12 million patients from Quest Diagnostics, another 7.7 million patients from LabCorp and 400,000 victims from OPKO Health.
Capital One: Another Year, Another Major FinServ Breach
In July, a massive breach of Capital One customer data hit more than 100 million people in the U.S. and 6 million in Canada. Thanks to a cloud misconfiguration, a hacker was able to access credit applications, Social Security numbers and bank account numbers in one of the biggest data breaches to ever hit a financial services company — putting it in the same league in terms of size as the Equifax incident of 2017. The FBI arrested a suspect in the case: A former engineer at Amazon Web Services (AWS), Paige Thompson, after she boasted about the data theft on GitHub. Researchers said that Capital One victims are going to be phished for years to come – long after their 12 months’ of credit monitoring is done.
Facebook ‘s Year of Breach Problems
Facebook had a bad year for breaches, including the December emergence of a hacked database containing the names, phone numbers and Facebook user IDs of 267 million platform users. The data may have been stolen from Facebook’s developer API before the company restricted API access to phone numbers and other data in 2018. And in September, an open server was discovered leaking hundreds of millions of Facebook user phone numbers. In April, researchers found two separate datasets, held by two app developers (Cultura Colectiva and At the Pool). The actual data source for the records (like account names and personal data) in these databases was Facebook.
Deep Profiles for the Entire Population of Ecuador Are Exposed
In September it came to light that the entire population of Ecuador (as well as Julian Assange) had been impacted by an open database with rich, detailed life information collected from public-sector sources by a marketing analytics company. The trove of data offered any attacker the ability to cross-reference and combine the data into a highly personal, richly detailed view of a person’s life. The records, for 20 million individuals, were gleaned from Ecuadorian government registries, an automotive association called Aeade, and the Ecuadorian national bank. Ecuador has about 16.5 million citizens in total (some of the entries were for deceased persons).
1.2B Rich Profiles Exposed By Data Brokers
In a similar incident to the Ecuador debacle, an open Elasticsearch server emerged in December that exposed the rich profiles of more than 1.2 billion people. The database consisted of scraped information from social media sources like Facebook and LinkedIn, combined with names, personal and work email addresses, phone numbers, Twitter and Github URLs and other data. Taken together, the profiles provide a 360-degree view of individuals, including their employment and education histories. All of the information was unprotected, with no login needed to access it. The data was linked to People Data Labs (PDL) and OxyData[.]io.
Security Specialist Imperva Smarts from Cloud Misconfiguration
In an ironic turn of events, cybersecurity company Imperva allowed hackers to steal and use an administrative Amazon Web Services (AWS) API key in one of Imperva’s production AWS accounts, thanks to a cloud misconfiguration. Hackers used Imperva’s Cloud Web Application Firewall (WAF) product to access a database snapshot containing emails, hashed and salted passwords, and some customers’ API keys and TLS keys. Because the database was accessed as a snapshot, the hackers made off with only old Incapsula records that go up to Sept. 15, 2017. However, the theft of API keys and SSL would allow an attacker to break companies’ encryption and access corporate applications directly.
Sprint Contractor Lays Open Phone Bills for 260K Subscribers
A cloud misconfig was also behind hundreds of thousands of mobile phone bills for AT&T, Verizon and T-Mobile subscribers being exposed to the open internet in December, thanks to the oversight of a contractor working with Sprint. More than 261,300 documents were stored – mainly cell phone bills from Sprint customers who switched from other carriers. Cell phone bills are a treasure trove of data, and include names, addresses and phone numbers along with spending histories and in many cases, call and text message records.
Magecart Siphons Off Millions of Payment Card Details
Magecart, the digital card-skimming collective encompassing several different affiliates all using the same modus operandi, is now so ubiquitous that its infrastructure is flooding the internet, researchers said earlier this year. Magecart attacks, which involve inserting virtual credit-card skimmers into e-commerce check-out pages, affected a range of companies throughout 2019; these included bedding retailers MyPillow and Amerisleep, the subscription website for the Forbes print magazine, at least 80 reputable brands in the motorsports industry and luxury apparel segments, popular skin care brand First Aid Beauty, Macy’s and streaming video and podcast content company Rooster Teeth.
Equifax Settlement Rankles Consumers
Equifax made notable news this year when it agreed to pay as much as $700 million to settle federal and state investigations on the heels of its infamous 2017 breach, which exposed the data of almost 150 million customers. That includes $300 million to cover free credit monitoring services for impacted consumers, $175 million to 48 states in the U.S, and $100 million in civil penalties. Some consumers are furious over what they view as an unfair settlement though, with 200,000 of them signing a petition against the deal. The petition argues that very little of that cash will trickle down to those who actually suffered because of the breach.
