Biggest data breaches of 2015
0 likes604 views
In 2015, several significant data breaches occurred, affecting millions, including Anthem (80 million records), Ashley Madison (37 million), and the U.S. Office of Personnel Management (21.5 million). Most breaches involved sensitive personal information and were attributed to various cybercriminals, including suspected state-sponsored hackers. Recommendations for improved security include better encryption, detection technologies, and heeding warnings about potential vulnerabilities.
Biggest data breaches of 2015
- 1. InvisiBits 12/30/2015 Biggest Data Breaches of 2015
- 2. Anthem 80 million Ashley Madison 37 million OPM 21.5 million Experian 15 million Premera 11 million LastPass 7 million
- 4. Anthem Revealed in February (2015) APT attack probably started in April 2014 5th largest data breach of all time Breached data includes social security numbers, birthdays, street addresses, phone numbers and income data Likely by Chinese hackers (Deep Panda) Attackers created a bogus domain name, "we11point.com," (based onWellPoint, the former name ofAnthem) that may have been used in phishing-related attacks.
- 5. Ashley Madison Ashley Madison 37 million
- 6. Ashley Madison A website that encourages people to cheat on their partners A hacking group known as ImpactTeam stole private information Hacked in July (2015) Leaked 20 GB data inAugust (which had many social consequences including suicides) Breached data includes e-mail addresses and account details Suspects to be an insider attack but does not know for sure
- 7. U.S. Office of Personal Management OPM 21.5 million
- 8. U.S. Office of Personal Management Attack started inApril 2014 Detected in May (2015) and notified in June (2015) Breached data contains security clearance data of past and current federal workers - including fingerprints, Social Security numbers, addresses, employment history, and financial records Believed to be originated from China They have carried out two attacks
- 10. Experian The world’s largest consumer credit monitoring firm Breach disclosed in October (2015) Breached data includesT-Mobile customers who underwent credit checks by Experian (customer names, addresses, Social Security numbers, birthdays, and even sensitive identification numbers) Consumer facing companies (e.g.T-mobile) should take more stringent measures to protect their data at data aggregators (e.g. Experian) The attack seems to have originated in CourtVenture which Experian had acquired by a humanTrojan
- 11. Premera Blue Cross Blue Shield Premera 11 million
- 12. Premera Blue Cross Blue Shield Occurred in May 2014, but discovered only in January Disclosed in March Breached data includes names, dates of birth, Social Security numbers, addresses, bank-account information and claim information, including clinical information The same group that hackedAnthem seems to have carried out the attack Customers are phished to a fake domain prennera.com Fed had warned about security flaws before the attack, no action was taken
- 14. LastPass A cloud based password management company Disclosed the attack in June (2015) Breached data includes users’ email addresses, encrypted master passwords, and the reminder words and phrases that the service asks users to create for those master passwords Due to strong encryption, breached users seem to safe, but the company advised users to reset their master passwords as a precautionary measure
- 15. What to do in 2016? Two of the breaches include state sponsored attacks – need better security infrastructures to protect and monitor government assets Two of the breaches on healthcare data – hackers are after personal data – similar to government data, healthcare data needs to be better protected Encrypt your data – LastPass leaked master passwords were strongly protected which averted a catastrophic consequence Have good detection technologies in place – most of the attacks took months to discover Take warnings seriously – Premera was warned, but did not take any actions before the attack happened Make sure the same mistake does not happen again – Experian got hacked twice – not enough action after the first attack Live online the same way you live offline – internet cannot hide you forever (Ashley Madison)