Table of Contents
The personal information of millions of people around the world was compromised in 2018 due to a whopping 1,100+ data breaches. Every week, a new healthcare provider, social network, or retailer had to inform its customer base that their details were affected by a breach.
As such, 2018 will long be recalled as the most prolific year in data security – everything from passport numbers and bank account information to email addresses and names had been leaked! Some of the most high-profile victims include Quora, Google+, and Marriot.
Facebook also faced multiple incidents and breaches which affected over 100 million users and resulted in them paying fines worth millions of dollars! With that being said, let’s take a closer look at some of 2018’s most notable data breaches:
1. Aadhaar
How many records were exposed?
1.1 billion
What was stolen?
Indian residents’ personal information, including names, unique ID numbers, and bank details.
When did the incident take place?
It’s uncertain when the breach hit India’s national ID database, but it was unearthed in March 2018.
How it occurred?
The data leak stemmed from a state-owned utility company called Indane. They failed to secure the API used to access the database, allowing anyone to download private Aadhaar information.
2. Marriott Starwood
How many records were exposed?
500 million
What was stolen?
Guest details, including reservation dates, phone numbers, passport numbers, and email address. The stolen data also consisted of some payment card numbers as well as expiration dates.
When did the incident take place?
There had been unauthorized access to Marriott’s Starwood guest reservation database since 2014. It was discovered in September 2018.
How it occurred?
According to Marriot International, a Chinese spy agency allegedly “hacked health insurers and the security clearance files of millions more Americans” before gaining access to the Starwood guest database and copying and stealing information.
3. Exactis
How many records were exposed?
340 million
What was stolen?
In-depth information collected on millions of businesses and people, including addresses, phone numbers, personal characteristics and interests, and more.
When did the incident take place?
News of the data breach emerged in June 2018.
How it occurred?
A security researcher found that Exactis’ database was left exposed on a publicly accessible server, though it’s unclear whether the information was accessed by any hackers.
4. Twitter
How many records were exposed?
330 million.
What was stolen?
Users passwords.
When did the incident take place?
To this date, the exact time of the incident is unclear.
How it occurred?
Twitter found out a bug on its website which stored passwords exposed in an internal file. While it isn’t really a breach, it’s certainly exposing sensitive data which could prove to be harmful for the user and the company. As a result, Twitter asked all of its users to reset their passwords.
5. MyFitnessPal
How many records were exposed?
150 million
What was stolen?
Personal information including email addresses, encrypted passwords, and usernames.
When did the incident take place?
The data breach happened on February 2018, but it first came to light in March.
How it occurred?
Law enforcement agencies and security firms are still investigating the real identity of the “unauthorized party” behind the data breach.
6. Quora
How many records were exposed?
100 million
What was stolen?
Personally identifiable information, such as names, passwords, and email addresses. It also included data from linked networks and users’ public content like questions and answers.
When did the incident take place?
The data breach was uncovered in November 2018.
How it occurred?
One of Quora’s systems were hacked by “a malicious third party”, and the company is still looking into how it happened.
7. MyHeritage
How many records were exposed?
92 million
What was stolen?
Users’ email addresses and hashed passwords.
When did the incident take place?
According to the company, the data breach was carried out in October 2017. However, it was first spotted on June 2018.
How it occurred?
The details of MyHeritage users’ was found sitting on a private server belonging to an unrecognized party.
8. Facebook-Cambridge Analytica
How many records were exposed?
87 million
What was stolen?
Data identifying the interests and preferences of users.
When did the incident take place?
Facebook learned of Cambridge Analytica’s illicit harvesting of data in 2015 but didn’t inform users until 2018.
How it occurred?
An app called “thisisyourdigitallife”, which was developed by Cambridge University professor Aleksandr Kogan enabled Cambridge Analytica to improperly access user information and influence the presidential campaign in Trump’s favor.
270,000 or so users only installed it, but Facebook’s design at that time allowed the app to collect data on their millions of friends as well.
9. Google+
How many records were exposed?
Almost 53 million
What was stolen?
Private information on users’ profiles, including name, age, employer, job title, relationship status, birth date, and email address.
When did the incident take place?
The first data breach – which was announced by Google in October last year – happened between 2015 and March 2018, while the second one affected users between November 7 and November 13.
How it occurred?
Google announced its shutting down Google+ in August 2019 after a “security bug” gave third-party developers access to the profile data of 500,000 users. However, it moved the date to April 2019 due to a similar bug which exposed the information of 52.5 million users.
10. Chegg
How many records were exposed?
40 million
What was stolen?
Personal information, including shipping addresses, usernames, hashed passwords, and email addresses.
When did the incident take place?
The data breach happened in late April 2018, but it was only disclosed in September.
How it occurred?
Chegg reported the incident in an 8-K form filed with the SEC, and stated that “an unauthorized party gained access to a Company database that hosts user data for chegg.com and certain of the Company’s family of brands such as EasyBib.”
11. Panera Bread
How many records were exposed?
37 million.
What was stolen?
All the personal details including names, addresses, email addresses, phone numbers, dates of birth, and the last four digits of customer credit card numbers.
When did the incident take place?
The data breach took place from August 2nd, 2017, to April 2nd, 2018. While it was first discovered in August 2017, it was publically disclosed on April 2nd, 2018.
How it occurred?
A database leak led to the plaintext exposure of customer records. Panera was notified on August 2, 2017, but ignored repeated requests by security researchers to fix the database leak. Eight months later, they secured the leak.
12. Facebook
How many records were exposed?
30 million
What was stolen?
Sensitive information, including recent searches, locations, relationship status, contact details, and devices used to access Facebook.
When did the incident take place?
The vulnerability was introduced on Facebook in July 2017 and uncovered in September 2018.
How it occurred?
The attackers successfully exploited vulnerabilities in the popular social network’s code to steal “access tokens” – digital keys that enable Facebook to keep people logged in – and the collected users’ data without their knowledge.
13. Ticketfly
How many records were exposed?
27 million
What was stolen?
Personal data, including phone numbers, names, email addresses, and physical addresses.
When did the incident take place?
Ticketfly fell victim to the “malicious cyberattack” in late May 2018.
How it occurred?
The data breach was carried out by a hacker known as IsHaKdZ. They gained access to Ticketfly’s “backstage” database – which contains client info for all the festivals, venues, and promoters that utilize their services – by compromising the site’s webmaster.
14. Timehop
How many records were exposed?
21 million
What was stolen?
Personal data was compromised, including names, date of births, phone numbers, and email addresses.
When did the incident take place?
Timehop faced a network intrusion in July 2018.
How it occurred?
The attacker used compromised admin credentials to access Timehop’s cloud computing environment and create a new account. Surprisingly, the initial account used to access the company’s cloud computing servers wasn’t secured with 2FA.
15. Sacramento Bee
How many records were exposed?
19.5 million.
What was stolen?
All the personal details including names, addresses, email addresses, phone numbers, party affiliations, dates of birth, places of birth.
When did the incident take place?
Sacramento Bee suffered the data breach on January 2017. However, it wasn’t until February 7th, 2018 that it was disclosed to the public.
How it occurred?
Hackers were able to seize a voter registration database the Bee had obtained from the state for reporting purposes and another of personal information of Bee subscribers.
16. Careem
How many records were exposed?
14 million
What was stolen?
Phone numbers, names, trip data, and email addresses.
When did the incident take place?
The data breach was carried out in January 2018 but wasn’t disclosed until April.
How it occurred?
Hackers gained access to a computer system which stored drive and customer account information.
17. Cathay Pacific Airways
How many records were exposed?
9.4 million
What was stolen?
Personal information, including names, home addresses, ID card numbers, email addresses, passport numbers, date of births, and credit card numbers.
When did the incident take place?
Suspicious activity was detected in March 2018.
How it occurred?
It’s still not clear who was behind the data breach and how they accessed passenger data “without authorization”.
18. SHEIN
How many records were exposed?
6.42 million
What was stolen?
Encrypted passwords and email addresses of customers.
When did the incident take place?
SIEN was breached sometime in June 2018, but it wasn’t until late August that they came to know about it.
How it occurred?
According to the fashion retailer, the hack was the result of a sophisticated cyberattack on their computer network.
19. Saks and Lord & Taylor
How many records were exposed?
5 million
What was stolen?
Data on credit and debit cards used at the stores in North America.
When did the incident take place?
The exact date of the breach hasn’t been shared.
How it occurred?
A hacking group known as JokerStash announced that it had put up the payment card information of Saks and Lord & Taylor customers for sale on the “dark web”.
20. myPersonality
How many records were exposed?
4 million
What was stolen?
Intimate details of Facebook users who used the rogue app, including psychological test results.
When did the incident take place?
Just months after the Facebook-Cambridge Analytica data scandal. The app was then banned from the social network in April 2018.
How it occurred?
The myPersonality app mishandled sensitive information by sharing it with researchers and companies.
21. T-Mobile
How many records were exposed?
About 2 million
What was stolen?
Email addresses, encrypted passwords, billing information, and account numbers.
When did the incident take place?
The company was hit by a data breach in August 2018.
How it occurred?
Hackers were able to gain access to T-Mobile’s servers by exploiting a vulnerability in an API.
22. Orbitz
How many records were exposed?
880,000.
What was stolen?
Card and personal information such as billing addresses, phone numbers, and emails.
When did the incident take place?
The data breach took place from January 1st, 2016 to December 22nd, 2017.
How it occurred?
Hackers were able to access travel bookings in the website’s system.
23. British Airways
How many records were exposed?
380,000.
What was stolen?
Card payments which included names, home addresses, and email addresses.
When did the incident take place?
According to British Airways, the data breach was carried out from August 21st, 2018 to September 5th, 2018, and was first discovered on September 6th, 2018. However, it was disclosed to the public on September 7th, 2018.
How it occurred?
The hacking group injected malicious code on the unsecured webpage of British Airways’ website.
Wrapping Things Up
We’d recommend staying up-to-date with the latest happenings in terms of data breaches so that you can keep a check on everything that requires your immediate attention. Wishing everybody a safer 2019 from the team here at PureVPN – the world’s fastest VPN service!
Haris Shahid
June 20, 2023
10 months ago
