Biggest data breaches 2018

The 18 Biggest Data Breaches of 2018

The personal information of millions of people around the world was compromised in 2018 due to a whopping 1,100+ data breaches. Every week, a new healthcare provider, social network, or retailer had to inform its customer base that their details were affected by a breach.

As such, 2018 will long be recalled as the most prolific year in data security – everything from passport numbers and bank account information to email addresses and names had been leaked! Some of the most high-profile victims include Quora, Google+, and Marriot.

Facebook also faced multiple incidents and breaches which affected over 100 million users and resulted in them paying fines worth millions of dollars! With that being said, let’s take a closer look at some of 2018’s most notable data breaches:

1. Aadhaar

adhaar data breach

How many records were exposed?

1.1 billion

What was stolen?

Indian residents’ personal information, including names, unique ID numbers, and bank details.

When did the incident take place?

It’s uncertain when the breach hit the India’s national ID database, but it was unearthed in March 2018.

How it occurred?

The data leak stemmed from a state-owned utility company called Indane. They failed to secure the API used to access the database, allowing anyone to download private Aadhaar information.

2. Marriott Starwood

marriott starwood data breach

How many records were exposed?

500 million

What was stolen?

Guest details, including reservation dates, phone numbers, passport numbers, and email address. The stolen data also consisted of some payment card numbers as well as expiration dates.

When did the incident take place?

There had been unauthorized access to Marriott’s Starwood guest reservation database since 2014. It was discovered on September 2018.

How it occurred?

According to Marriot International, a Chinese spy agency allegedly “hacked health insurers and the security clearance files of millions more Americans” before gaining access to the Starwood guest database and copying and stealing information.

3. Exactis

exactis data breach

How many records were exposed?

340 million

What was stolen?

In-depth information collected on millions of businesses and people, including addresses, phone numbers, personal characteristics and interests, and more.

When did the incident take place?

News of the data breach emerged on June 2018.

How it occurred?

A security researcher found that Exactis’ database was left exposed on a publicly accessible server, though it’s unclear whether the information was accessed by any hackers.

4. MyFitnessPal

myfitnesspal data breach

How many records were exposed?

150 million

What was stolen?

Personal information including email addresses, encrypted passwords, and usernames.

When did the incident take place?

The data breach happened on February 2018, but it first came to light in March.

How it occurred?

Law enforcement agencies and security firms are still investigating the real identity of the “unauthorized party” behind the data breach.

5. Quora

quora data breach

How many records were exposed?

100 million

What was stolen?

Personally identifiable information, such as names, passwords, and email addresses. It also included data from linked networks, and users’ public content like questions and answers.

When did the incident take place?

The data breach was uncovered in November 2018.

How it occurred?

One of Quora’s systems were hacked by “a malicious third party”, and the company is still looking into how it happened.

6. MyHeritage

myheritage data breach

How many records were exposed?

92 million

What was stolen?

Users’ email addresses and hashed passwords.

When did the incident take place?

According to the company, the data breach was carried out in October 2017. However, it was first spotted on June 2018.

How it occurred?

The details of MyHeritage users’ was found sitting on a private server belonging to an unrecognized party.

7. Facebook-Cambridge Analytica

facebook cambridge analytica data scandal

How many records were exposed?

87 million

What was stolen?

Data identifying the interests and preferences of users.

When did the incident take place?

Facebook learned of Cambridge Analytica’s illicit harvesting of data in 2015, but didn’t inform users until 2018.

How it occurred?

An app called “thisisyourdigitallife”, which was developed by Cambridge University professor Aleksandr Kogan, enabled Cambridge Analytica to improperly access user information and influence the presidential campaign in Trump’s favor.

It was only installed by 270,000 or so users, but Facebook’s design at that time allowed the app to collect data on their millions of friends as well.

8. Google+

google+ data breach

How many records were exposed?

Almost 53 million

What was stolen?

Private information on users’ profiles, including name, age, employer, job title, relationship status, birth date, and email address.

When did the incident take place?

The first data breach – which was announced by Google in October last year – happened between 2015 and March 2018, while the second one affected users between November 7 and November 13.

How it occurred?

Google announced its shutting down Google+ in August 2019 after a “security bug” gave third-party developers access to the profile data of 500,000 users. However, it moved the date to April 2019 due to a similar bug which exposed the information of 52.5 million users.

9. Chegg

chegg data breach

How many records were exposed?

40 million

What was stolen?

Personal information, including shipping addresses, usernames, hashed passwords, and email addresses.

When did the incident take place?

The data breach happened in late April 2018, but it was only disclosed in September.

How it occurred?

Chegg reported the incident in an 8-K form filed with the SEC, and stated that “an unauthorized party gained access to a Company database that hosts user data for chegg.com and certain of the Company’s family of brands such as EasyBib.”

10. Facebook

facebook data breach

How many records were exposed?

30 million

What was stolen?

Sensitive information, including recent searches, locations, relationship status, contact details, and devices used to access Facebook.

When did the incident take place?

The vulnerability was introduced on Facebook in July 2017, and uncovered in September 2018.

How it occurred?

The attackers successfully exploited vulnerabilities in the popular social network’s code to steal “access tokens” – digital keys that enable Facebook to keep people logged in – and the collected users’ personal data without their knowledge.

11. Ticketfly

ticketfly data breach

How many records were exposed?

27 million

What was stolen?

Personal data, including phone numbers, names, email addresses, and physical addresses.

When did the incident take place?

Ticketfly fell victim to the “malicious cyberattack” in late May 2018.

How it occurred?

The data breach was carried out by a hacker known as IsHaKdZ. They gained access to Ticketfly’s “backstage” database – which contains client info for all the festivals, venues, and promoters that utilize their services – by compromising the site’s webmaster.

12. Timehop

timehop data breach

How many records were exposed?

21 million

What was stolen?

Personal data was compromised, including names, date of births, phone numbers, and email addresses.

When did the incident take place?

Timehop faced a network intrusion in July 2018.

How it occurred?

The attacker used compromised admin credentials to access Timehop’s cloud computing environment and create a new account. Surprisingly, the initial account used to access the company’s cloud computing servers wasn’t secured with 2FA.

13. Careem

Careem data breach

How many records were exposed?

14 million

What was stolen?

Phone numbers, names, trip data, and email addresses.

When did the incident take place?

The data breach was carried out in January 2018, but wasn’t disclosed until April.

How it occurred?

Hackers gained access to a computer system which stored drive and customer account information.

14. Cathay Pacific Airways

cathay pacific data breach

How many records were exposed?

9.4 million

What was stolen?

Personal information, including names, home addresses, ID card numbers, email addresses, passport numbers, date of births, and credit card numbers.

When did the incident take place?

Suspicious activity was detected in March 2018.

How it occurred?

It’s still not clear who was behind the data breach and how they accessed passenger data “without authorization”.

15. SHEIN

shien data breach

How many records were exposed?

6.42 million

What was stolen?

Encrypted passwords and email addresses of customers.

When did the incident take place?

SIEN was breached sometime in June 2018, but it wasn’t until late August that they came to know about it.

How it occurred?

According to the fashion retailer, the hack was the result of a sophisticated cyberattack on their computer network.

16. Saks and Lord & Taylor

saks and lord & taylor data breach

How many records were exposed?

5 million

What was stolen?

Data on credit and debit cards used at the stores in North America.

When did the incident take place?

The exact date of the breach hasn’t been shared.

How it occurred?

A hacking group known as JokerStash announced that it had put up the payment card information of Saks and Lord & Taylor customers for sale on the “dark web”.

17. myPersonality

How many records were exposed?

4 million

What was stolen?

Intimate details of Facebook users who used the rogue app, including psychological test results.

When did the incident take place?

Just months after the Facebook-Cambridge Analytica data scandal. The app was then banned from the social network in April 2018.

How it occurred?

The myPersonality app mishandled the sensitive information by sharing it with researchers and companies.

18. T-Mobile

t-mobile data breach

How many records were exposed?

About 2 million

What was stolen?

Email addresses, encrypted passwords, billing information, and account numbers.

When did the incident take place?

The company was hit by a data breach in August 2018.

How it occurred?

Hackers were able to gain access to T-Mobile’s servers by exploiting a vulnerability in an API.

Wrapping Things Up

We’d recommend staying up-to-date with the latest happenings in terms of data breaches, so that you can keep a check on everything that requires your immediate attention. Wishing everybody a safer 2019 from the team here at PureVPN – the world’s fastest VPN service!

Haris Shahid has a genuine passion in covering the latest happenings in the cyber security, privacy, and digital landscape. He likes getting out and about, but mostly ends up spending too much of his time behind a computer keyboard. He tweets at @harisshahid01

Join 3 million+ users to embrace internet freedom

Signup for PureVPN to get complete online security and privacy with a hidden IP address and encrypted internet traffic.

Shares