Data breaches are a constant threat to consumers. In just the first part of 2018, many companies were hacked following a year wrought with attacks, some making history as the largest in recent years like Yahoo and Equifax incidents. In the wake of these devastating events, there’s one thing we can be sure of: data is the new currency. It has become a primary resource to power, inciting the ever-evolving sophistication of hackers. Last year, it was reported that incidents of cyber attack targeting businesses nearly doubled. Unfortunately, attacks are inevitable, even in an age where most major businesses have amped up cybersecurity spending significantly.
Below are 5 major data breaches that compromised customer information so far this year. With the projections for the year being as they are, we’re sure to see many more before the year is out.
1. Under Armour
The company announced in March an unauthorized party acquired information from $150 million users of the app, MyFitnessPal, owned by the company. User information that was compromised included usernames, email addresses, and passwords, leaving users vulnerable to identity theft. The data breach took place in February. Luckily, Under Armour seemed to avoid leaking dietary, fitness, and exercise stats—health credentials that are now considered to be 10 to 20 times more valuable than stolen credit card information. With the valuable personal information, a hacker could potentially attain information about individuals’ whereabouts. This being considered, Under Armour dodged an even more severe incident.
Reportedly, Under Armour and MyFitnessPal have fairly good data practices in place. They were able to respond quickly and notified users and the public almost immediately after the breach was discovered. It serves as a good reminder that all our personal data is valuable and vulnerable to attack. Smart devices and apps gather huge amounts of data that can add up to a profile of who and where you are.
2. Facebook
The incidents involving Cambridge Analytica have been making waves and igniting larger discussions regarding privacy in the 2018 incident coverage. 87 million user profile details were compromised in the event, leaving the company in a state of desperation as it continues to work to mend a severely damaged reputation. The massive data scandal involving Facebook’s connection with the London-based consultancy Cambridge Analytica created huge news this year in the dispute over the alleged harvesting and use of personal data. In March of this year, the Federal Trade Commission (FTC) opened an investigation over user privacy protections and Mark Zuckerberg, co-founder and CEO of Facebook has been under scrutiny with recent testimony regarding the incident.
The extreme nature of this high profile breach might prove it to be the largest cybersecurity incident of the year. As coverage continues to occur, the event is currently classified as fraud and has sparked many controversial conversations around the importance of data privacy.
3. FedEx
In February of this year, Kromtech Security identified that the private information of roughly 119,000 customers of FedEx, found on an unsecured Amazon Web Services cloud storage server. The leaked information included driver licenses, names, home addresses, passports, and phone numbers of the customers. The exposed data were reportedly stored on the unsecured Amazon S3 virtual server that included records from 2009-2012, belonging to Bongo International, which was acquired by FedEx in 2014.
Kromtech reported that its researchers found that the Amazon S3 cloud storage was set for public access. US Postal Service forms containing names, home address, ZIP codes, and phone numbers were also found.
4. Saks Fifth Avenue and Lord & Taylor
This past April, one of the largest known breaches affected the luxury retailer, compromising more than five million credit and debit card numbers from customers. The data was stolen by cybercriminals using software through the cash register systems at the stores and siphoned the card numbers. Customer payment information was stolen at some Saks Fifth Avenue, Saks Off 5th, and Lord & Taylor stores in North America. The incident illustrates how difficult it is to secure credit card transaction systems.
There was no definitive determination regarding how the malware was installed in the stores' systems; however, it was reported that it was most likely through phishing emails received by Hudson's Bay employees. By clicking on links within the emails, secret installation of software can be achieved by allowing the attackers a backdoor into the system.
5. Orbitz
This past March, Orbitz, the travel fare aggregator service, discovered that someone gained unauthorized access to one of the company’s legacy travel booking platforms. The event was classified as hacking, exposing 880,000 customers’ payment card information during the months of October through December of 2017. Orbitz believes that the malicious attacker gained permissions to view the sensitive information of customer names, dates of birth, phone numbers, email addresses, billing addresses, gender, and payment card information.
One lesson that can be gleaned from this unfortunate incident is the importance of replacing outdated legacy software. Obsolete or outdated systems can be a huge security risk, especially as they stop receiving support, security patches, and updates. Orbitz is of course not the only big company to make this mistake, funding to replace legacy software is an obstacle for many organizations. However, research suggests that shifting money from maintaining outdated legacy IT systems to spending on new updated ones can boast a five percent reduction in the number of security incidents.
For more information or to speak with Crossroads Technologies, Advisory Services Division, contact us at 1 (866) 216-4366 or engageThis email address is being protected from spambots. You need JavaScript enabled to view it..
Articles You Might Find Interesting:
Are you Ready for the GDPR to Go into Effect?
5 Things Every CEO Should Know About the GDPR
Is Shadow IT Infiltrating Your Business without Your Knowledge?
The GDPR is Almost Here, What Does that Mean for Healthcare Organizations?
Share this article: