{ "api_version": 1, "generated": "2026-10-29", "documentation": "https://www.myrecon.xyz/developers.html", "licence": "All rights reserved. Index may be used to link to the articles.", "attribution": { "required": true, "author": "MyRecon", "author_url": "https://www.myrecon.xyz", "notice": "Case file summaries are original MyRecon writing. This index may be used to link to them. Reproducing the article text requires a visible credit and a link to the article it came from." }, "count": 60, "case_files": [ { "slug": "irhythm-2026", "url": "https://www.myrecon.xyz/breaches/case-files/irhythm-2026.html", "headline": "iRhythm 2026: June access, October notifications", "subject": "iRhythm 2026 data breach", "description": "iRhythm reported third-party application access in June 2026 and began notices in October. Review the confirmed timeline, exposed data and remaining unknowns.", "occurred": "3–8 June 2026", "disclosed": "June 2026; notification update 2 October 2026", "people_count": 0, "vector": "Unauthorized access to third-party-hosted business applications; entry method not disclosed in the reviewed update", "exposed": [ "Patient names", "Contact information", "Patient account numbers", "Device serial numbers", "Insurance numbers", "Dates of service", "Dates of birth" ], "published": "2026-10-25", "updated": "2026-10-25", "reading_minutes": 2 }, { "slug": "star-health-2024", "url": "https://www.myrecon.xyz/breaches/case-files/star-health-2024.html", "headline": "Star Health, 2024: a data leak with a customer service bot", "subject": "Star Health customer data leak", "description": "Policy documents and medical reports belonging to Star Health customers were served on demand by Telegram chatbots, a leak distributed as a self-service product rather than a file.", "occurred": "Publicly surfaced August–September 2024", "disclosed": "September 2024", "people_count": 31000000, "vector": "Not established publicly; the insurer confirmed unauthorised access and disputed the attacker's account of how the data was obtained", "exposed": [ "Names", "Phone numbers", "Physical addresses", "Dates of birth", "Identity and tax numbers", "Medical reports", "Insurance policy documents", "Claim records" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 5 }, { "slug": "national-public-data-2024", "url": "https://www.myrecon.xyz/breaches/case-files/national-public-data-2024.html", "headline": "National Public Data, 2024: a company you never used, holding everything about you", "subject": "National Public Data breach", "description": "A background-check broker most people had never heard of leaked a file advertised at 2.9 billion records, including Social Security numbers, then went bankrupt.", "occurred": "Late 2023 – April 2024", "disclosed": "Offered for sale April 2024; published broadly in August 2024", "people_count": 134000000, "vector": "Never fully established publicly; a sister site was separately found publishing a plaintext password file", "exposed": [ "Names", "Current and historic addresses", "Social Security numbers", "Phone numbers", "Relatives and associates" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "att-2024", "url": "https://www.myrecon.xyz/breaches/case-files/att-2024.html", "headline": "AT&T, 2024: who called whom, for nearly every customer", "subject": "AT&T call records breach", "description": "AT&T lost six months of call and text metadata for nearly all its mobile customers. Not what was said, who spoke to whom, how often, and from roughly where.", "occurred": "April 2024 (covering records from 2022)", "disclosed": "12 July 2024", "people_count": 109000000, "vector": "A third-party cloud data warehouse account without multi-factor authentication", "exposed": [ "Phone numbers contacted", "Counts of calls and texts", "Call durations", "Cell site identifiers for some records" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "snowflake-2024", "url": "https://www.myrecon.xyz/breaches/case-files/snowflake-2024.html", "headline": "Snowflake, 2024: 165 companies breached without anyone touching Snowflake", "subject": "Snowflake customer account compromises", "description": "Around 165 companies including Ticketmaster and AT&T lost data from cloud warehouses via credentials stolen by infostealer malware with no MFA.", "occurred": "April – June 2024", "disclosed": "From late May 2024", "people_count": 560000000, "vector": "Credentials stolen by infostealer malware, used against cloud accounts that had no multi-factor authentication", "exposed": [ "Names", "Contact details", "Transaction and ticketing records", "Call and text metadata", "Banking data for some victims" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "change-healthcare-2024", "url": "https://www.myrecon.xyz/breaches/case-files/change-healthcare-2024.html", "headline": "Change Healthcare, 2024: one login, and American healthcare stopped billing", "subject": "Change Healthcare ransomware attack", "description": "A remote access portal without multi-factor authentication let ransomware into the company that processes a third of American medical claims. 190 million people were in the data.", "occurred": "February 2024", "disclosed": "21 February 2024", "people_count": 190000000, "vector": "Stolen credentials used on a Citrix remote access portal that had no multi-factor authentication", "exposed": [ "Names", "Addresses", "Dates of birth", "Social Security numbers", "Health insurance details", "Diagnoses and treatment information", "Billing and claims data" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "british-library-2023", "url": "https://www.myrecon.xyz/breaches/case-files/british-library-2023.html", "headline": "The British Library, 2023: the ransom was refused and the catalogue stayed dark", "subject": "British Library ransomware attack", "description": "Rhysida exfiltrated around 600GB and auctioned it. The lasting damage was not the data leaving, it was that thirty years of accumulated systems could not simply be switched back on.", "occurred": "Detected 28 October 2023", "disclosed": "31 October 2023", "people_count": 0, "vector": "Most likely compromised credentials for third-party access on a Terminal Services server provisioned without multi-factor authentication", "exposed": [ "Employee personal data", "Internal financial and HR documents", "Some user account data" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 4 }, { "slug": "okta-support-2023", "url": "https://www.myrecon.xyz/breaches/case-files/okta-support-2023.html", "headline": "Okta, 2023: the breach arrived through the help desk, inside debugging files", "subject": "Okta customer support system breach", "description": "Attackers reached Okta's support case system and read HAR files customers had uploaded for troubleshooting. Those files contained live session tokens.", "occurred": "September – October 2023", "disclosed": "20 October 2023", "people_count": 18400, "vector": "A service account whose credentials had been saved into a personal Google profile on a managed device, used to access the customer support case management system and the HAR files stored in it", "exposed": [ "Session tokens and cookies in uploaded HAR files", "Customer support case contents", "Names and email addresses of support system users" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 5 }, { "slug": "23andme-2023", "url": "https://www.myrecon.xyz/breaches/case-files/23andme-2023.html", "headline": "23andMe, 2023: 14,000 accounts opened the door to 6.9 million people", "subject": "23andMe credential stuffing breach", "description": "Attackers logged into 14,000 accounts with recycled passwords. A feature that connects relatives then exposed 6.9 million people who had done nothing wrong.", "occurred": "April – September 2023", "disclosed": "October 2023", "people_count": 6900000, "vector": "Credential stuffing with passwords from earlier breaches, amplified by the DNA Relatives feature", "exposed": [ "Names", "Profile photos", "Birth years", "Locations", "Ancestry and ethnicity estimates", "Relationship labels between matched relatives" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "mgm-resorts-2023", "url": "https://www.myrecon.xyz/breaches/case-files/mgm-resorts-2023.html", "headline": "MGM Resorts, 2023: a ten-minute phone call to the help desk", "subject": "MGM Resorts cyberattack", "description": "Attackers found an MGM employee on LinkedIn, called the IT help desk pretending to be them, and got a password reset. Slot machines and room keys stopped working for ten days.", "occurred": "September 2023", "disclosed": "11 September 2023", "people_count": 0, "vector": "Social engineering of the IT help desk to obtain a credential reset, then abuse of the identity provider", "exposed": [ "Names", "Contact details", "Dates of birth", "Driver's licence numbers", "A smaller set of Social Security and passport numbers" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "moveit-2023", "url": "https://www.myrecon.xyz/breaches/case-files/moveit-2023.html", "headline": "MOVEit, 2023: one file transfer product, 2,700 organisations", "subject": "MOVEit Transfer mass exploitation", "description": "A zero-day in a file transfer product let one criminal group steal data from thousands of organisations over a single weekend, most of which had never heard of it.", "occurred": "27 May 2023 onwards", "disclosed": "31 May 2023", "people_count": 90000000, "vector": "A SQL injection zero-day (CVE-2023-34362) in Progress MOVEit Transfer", "exposed": [ "Names", "Addresses", "Dates of birth", "Social Security and national ID numbers", "Payroll and pension data", "Health data, depending on the victim organisation" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "latitude-financial-2023", "url": "https://www.myrecon.xyz/breaches/case-files/latitude-financial-2023.html", "headline": "Latitude Financial, 2023: a licence number from 2005, stolen in 2023", "subject": "Latitude Financial data breach", "description": "Around 7.9 million driver's licence numbers and 6.1 million older records, some dating to 2005, taken from a lender using credentials stolen from an employee.", "occurred": "Detected 16 March 2023", "disclosed": "16 March 2023", "people_count": 14000000, "vector": "Employee login credentials stolen and used to access two service providers holding customer data", "exposed": [ "Driver's licence numbers", "Passport numbers", "Names", "Physical addresses", "Phone numbers", "Dates of birth" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 5 }, { "slug": "lastpass-2022", "url": "https://www.myrecon.xyz/breaches/case-files/lastpass-2022.html", "headline": "LastPass, 2022: the vaults were stolen, and then attacked offline", "subject": "LastPass data breach", "description": "An engineer's home media server was the way into a password manager's cloud backups. Customer vaults were copied, and attackers have been cracking them ever since.", "occurred": "August and November 2022", "disclosed": "August 2022; full scope disclosed December 2022", "people_count": 25000000, "vector": "A compromised developer account, then a vulnerability in third-party software on a senior engineer's home computer", "exposed": [ "Encrypted password vaults", "Website URLs stored in vaults (unencrypted)", "Names", "Billing addresses", "Email addresses", "Phone numbers", "IP addresses" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "aiims-delhi-2022", "url": "https://www.myrecon.xyz/breaches/case-files/aiims-delhi-2022.html", "headline": "AIIMS Delhi, 2022: the hospital went back to paper, and the record stayed thin", "subject": "AIIMS Delhi ransomware attack", "description": "Ransomware took India's flagship public hospital offline for weeks. What was taken, whether a ransom was demanded, and who was responsible were never established publicly.", "occurred": "23 November 2022", "disclosed": "23 November 2022", "people_count": 0, "vector": "Not established publicly; ransomware affecting servers hosting the hospital's e-hospital systems", "exposed": [ "Patient records (extent unverified)", "Hospital administrative systems", "Clinical service availability" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 5 }, { "slug": "medibank-2022", "url": "https://www.myrecon.xyz/breaches/case-files/medibank-2022.html", "headline": "Medibank, 2022: the company said no, and the data went up anyway", "subject": "Medibank data breach", "description": "Medibank refused to pay the ransom. The attackers published 9.7 million customers' health claims data in tranches, organised to cause the most distress.", "occurred": "August – October 2022", "disclosed": "October 2022", "people_count": 9700000, "vector": "Stolen credentials belonging to a third-party IT contractor, with no multi-factor authentication", "exposed": [ "Names", "Dates of birth", "Addresses", "Phone numbers", "Medicare and policy numbers", "Health claims data including procedures and diagnoses" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "optus-2022", "url": "https://www.myrecon.xyz/breaches/case-files/optus-2022.html", "headline": "Optus, 2022: an API with no lock on it, and 9.8 million Australians", "subject": "Optus data breach", "description": "An internet-facing Optus API required no authentication at all. Anyone who found it could walk the customer database, including identity document numbers.", "occurred": "September 2022", "disclosed": "22 September 2022", "people_count": 9800000, "vector": "An internet-facing API endpoint that required no authentication and allowed enumeration of customer records", "exposed": [ "Names", "Dates of birth", "Phone numbers", "Email addresses", "Addresses", "Passport numbers", "Driver's licence numbers", "Medicare numbers" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "uber-2022", "url": "https://www.myrecon.xyz/breaches/case-files/uber-2022.html", "headline": "Uber, 2022: multi-factor authentication held, and then somebody sent a WhatsApp message", "subject": "Uber 2022 internal systems breach", "description": "A contractor's password was bought, their phone was buried in approval prompts, and a helpful message finished the job. The real prize was an admin credential sitting in a script.", "occurred": "15 September 2022", "disclosed": "15 September 2022", "people_count": 0, "vector": "Stolen contractor credentials, multi-factor fatigue plus social engineering over WhatsApp, then hardcoded privileged credentials found in an internal PowerShell script", "exposed": [ "Internal collaboration and messaging systems", "Cloud and identity administration consoles", "Internal vulnerability reports" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 5 }, { "slug": "twilio-0ktapus-2022", "url": "https://www.myrecon.xyz/breaches/case-files/twilio-0ktapus-2022.html", "headline": "0ktapus, 2022: one text message, one hundred and thirty companies", "subject": "0ktapus phishing campaign", "description": "A single SMS phishing campaign harvested credentials and one-time codes from employees at more than 130 companies. Cloudflare was targeted with the same messages and lost nothing.", "occurred": "July – August 2022", "disclosed": "August 2022", "people_count": 0, "vector": "SMS phishing to employees, directing them to convincing fake single sign-on pages that relayed credentials and one-time codes in real time", "exposed": [ "Corporate credentials", "One-time passcodes", "Customer support tooling access", "Phone numbers of 1,900 Signal users" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "twitter-2022", "url": "https://www.myrecon.xyz/breaches/case-files/twitter-2022.html", "headline": "Twitter, 2022: an API that confirmed which account owned which email", "subject": "Twitter API data exposure", "description": "A bug let anyone submit an email address or phone number and be told which Twitter account it belonged to. For pseudonymous users, that is the whole threat model.", "occurred": "June 2021 – January 2022", "disclosed": "August 2022", "people_count": 5400000, "vector": "An API flaw allowing an email address or phone number to be resolved to an account", "exposed": [ "Email addresses", "Phone numbers", "The linked account handle and public profile data" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 3 }, { "slug": "t-mobile-2021", "url": "https://www.myrecon.xyz/breaches/case-files/t-mobile-2021.html", "headline": "T-Mobile, 2021: an exposed router, and 76 million people who were mostly not customers", "subject": "T-Mobile data breach", "description": "An internet-exposed router led to a data centre and then to records on tens of millions of people, most of whom had only ever applied for service.", "occurred": "August 2021", "disclosed": "16 August 2021", "people_count": 76000000, "vector": "An internet-exposed router, then lateral movement into a data centre", "exposed": [ "Names", "Dates of birth", "Social Security numbers", "Driver's licence and ID numbers", "Phone numbers", "Account PINs for some prepaid customers" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "kaseya-2021", "url": "https://www.myrecon.xyz/breaches/case-files/kaseya-2021.html", "headline": "Kaseya, 2021: the update arrived on schedule and encrypted 1,500 companies", "subject": "Kaseya VSA supply chain ransomware attack", "description": "REvil exploited zero-days in Kaseya's remote management server to push ransomware down the trusted update channel into roughly 1,500 downstream businesses.", "occurred": "2 July 2021", "disclosed": "2 July 2021", "people_count": 0, "vector": "Authentication bypass and code injection in internet-facing Kaseya VSA servers, used to distribute a malicious agent update", "exposed": [ "Encrypted business systems", "Managed service provider tooling", "Operational downtime across unrelated industries" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 5 }, { "slug": "air-india-2021", "url": "https://www.myrecon.xyz/breaches/case-files/air-india-2021.html", "headline": "Air India, 2021: ten years of passengers, lost by a supplier", "subject": "Air India data breach", "description": "Air India lost 4.5 million passengers' data, including passport details going back a decade, because the company that runs its reservation platform was breached.", "occurred": "February 2021", "disclosed": "21 May 2021", "people_count": 4500000, "vector": "Compromise of SITA Passenger Service System, a shared platform used by many airlines", "exposed": [ "Names", "Dates of birth", "Contact details", "Passport information", "Ticket information", "Frequent flyer data", "Some payment card data, without CVV" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 3 }, { "slug": "colonial-pipeline-2021", "url": "https://www.myrecon.xyz/breaches/case-files/colonial-pipeline-2021.html", "headline": "Colonial Pipeline, 2021: one leaked password, and the fuel stopped", "subject": "Colonial Pipeline ransomware attack", "description": "A disused VPN account with no second factor let ransomware into the company that supplies nearly half the US East Coast's fuel. The pipeline stopped for six days.", "occurred": "6–7 May 2021", "disclosed": "8 May 2021", "people_count": 0, "vector": "A legacy VPN account with no multi-factor authentication, using a password found in a breach dump", "exposed": [ "Business systems and billing data", "Personal data of a small number of individuals" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "facebook-scrape-2021", "url": "https://www.myrecon.xyz/breaches/case-files/facebook-scrape-2021.html", "headline": "Facebook, 2021: 533 million phone numbers that were never \"hacked\"", "subject": "Facebook 533 million record scrape", "description": "Facebook was right that nobody broke in. Attackers abused a feature working as designed to match hundreds of millions of phone numbers to real profiles.", "occurred": "Before September 2019", "disclosed": "Data sold in 2020; published free in April 2021", "people_count": 533000000, "vector": "Abuse of the contact importer feature to match bulk phone numbers to profiles", "exposed": [ "Phone numbers", "Facebook IDs", "Names", "Genders", "Locations", "Relationship statuses", "Employers", "Some email addresses and dates of birth" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "mobikwik-2021", "url": "https://www.myrecon.xyz/breaches/case-files/mobikwik-2021.html", "headline": "MobiKwik, 2021: the breach that was denied while people searched their own KYC files", "subject": "MobiKwik alleged data leak", "description": "Data said to cover 99 million MobiKwik users was offered for sale with a portal where anyone could look themselves up. The company called the reports baseless. The RBI ordered an audit.", "occurred": "Reported from January 2021; the sale portal appeared in March 2021", "disclosed": "Never formally disclosed by the company", "people_count": 0, "vector": "Not established publicly", "exposed": [ "Phone numbers", "Email addresses", "Hashed passwords", "Addresses", "Alleged KYC documents including Aadhaar and PAN card images" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "accellion-2021", "url": "https://www.myrecon.xyz/breaches/case-files/accellion-2021.html", "headline": "Accellion FTA, 2021: the rehearsal for MOVEit", "subject": "Accellion File Transfer Appliance breach", "description": "Attackers found zero-day flaws in a twenty-year-old file transfer appliance nearing end of life and used them to rob central banks, regulators and hospitals at once.", "occurred": "Mid-December 2020 – January 2021", "disclosed": "January 2021", "people_count": 0, "vector": "Chained zero-day vulnerabilities in Accellion's File Transfer Appliance, a legacy product approaching end of life", "exposed": [ "Personal and financial records", "Medical records", "Regulatory filings", "Legal documents", "Government and central bank data" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "solarwinds-2020", "url": "https://www.myrecon.xyz/breaches/case-files/solarwinds-2020.html", "headline": "SolarWinds, 2020: 18,000 organisations installed the backdoor themselves", "subject": "SolarWinds supply chain attack", "description": "Attackers compromised SolarWinds' build system and shipped a backdoor inside a signed software update. Around 18,000 customers installed it. Fewer than 100 were the point.", "occurred": "September 2019 – June 2020", "disclosed": "8 December 2020", "people_count": 0, "vector": "Malicious code inserted into the SolarWinds Orion build pipeline and distributed as a digitally signed update", "exposed": [ "Government and corporate email", "Internal network access", "Source code", "Authentication tokens" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 5 }, { "slug": "clearview-ai-2020", "url": "https://www.myrecon.xyz/breaches/case-files/clearview-ai-2020.html", "headline": "Clearview AI, 2020: three billion faces, scraped and sold", "subject": "Clearview AI facial recognition database", "description": "Clearview AI built a face search engine from three billion images scraped off the public web, sold it to police forces, and then had its client list stolen.", "occurred": "2017 – 2020, exposed publicly in January 2020", "disclosed": "18 January 2020", "people_count": 0, "vector": "Mass automated scraping of public social media and websites, plus a February 2020 breach of the company's own client list", "exposed": [ "Face images", "Source URLs linking each face to its original profile", "Clearview's own client list and search counts" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "capital-one-2019", "url": "https://www.myrecon.xyz/breaches/case-files/capital-one-2019.html", "headline": "Capital One, 2019: a firewall misconfiguration and 106 million applicants", "subject": "Capital One data breach", "description": "A misconfigured web application firewall let an attacker ask the cloud for its own credentials, then read 106 million credit card applications out of storage.", "occurred": "March 2019", "disclosed": "29 July 2019", "people_count": 106000000, "vector": "Server-side request forgery through a misconfigured web application firewall, reaching cloud instance metadata", "exposed": [ "Names", "Addresses", "Phone numbers", "Email addresses", "Dates of birth", "Self-reported income", "Credit scores and balances", "140,000 Social Security numbers", "80,000 linked bank account numbers", "1 million Canadian Social Insurance numbers" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "first-american-2019", "url": "https://www.myrecon.xyz/breaches/case-files/first-american-2019.html", "headline": "First American, 2019: 885 million documents behind a number you could count up", "subject": "First American Financial document exposure", "description": "Sixteen years of mortgage paperwork, bank details, Social Security numbers, wire receipts, sat behind sequential document IDs in a URL, with no login of any kind.", "occurred": "Documents were reachable from at least 2003 until May 2019", "disclosed": "24 May 2019", "people_count": 0, "vector": "Insecure direct object reference, changing a document number in the URL returned another customer's file, with no authentication required", "exposed": [ "Bank account numbers", "Bank statements", "Mortgage and tax records", "Social Security numbers", "Wire transfer receipts", "Driver's licence images" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 5 }, { "slug": "collection-1-2019", "url": "https://www.myrecon.xyz/breaches/case-files/collection-1-2019.html", "headline": "Collection #1, 2019: 773 million addresses, and nobody was breached", "subject": "Collection #1 credential aggregate", "description": "Collection #1 was not a hack. It was 87GB of everyone else's hacks, merged and deduplicated into a single file built for one purpose: automated login attempts.", "occurred": "Circulating from late 2018", "disclosed": "17 January 2019", "people_count": 772904991, "vector": "Aggregation of thousands of earlier breaches into one deduplicated combination list", "exposed": [ "Email addresses", "Cracked plaintext passwords" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "marriott-starwood-2018", "url": "https://www.myrecon.xyz/breaches/case-files/marriott-starwood-2018.html", "headline": "Marriott and Starwood, 2018: a breach that came with the acquisition", "subject": "Marriott Starwood guest reservation database breach", "description": "Marriott bought Starwood in 2016. The reservation database it acquired had already been compromised for two years, and nobody found out until 2018.", "occurred": "2014 – September 2018", "disclosed": "30 November 2018", "people_count": 339000000, "vector": "Long-running compromise of the Starwood reservation system, present before the acquisition", "exposed": [ "Names", "Addresses", "Phone numbers", "Email addresses", "Passport numbers (5.25 million unencrypted)", "Arrival and departure dates", "Reservation details", "Some encrypted payment cards" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "british-airways-2018", "url": "https://www.myrecon.xyz/breaches/case-files/british-airways-2018.html", "headline": "British Airways, 2018: twenty-two lines of JavaScript", "subject": "British Airways data breach", "description": "A small change to a script on the BA payment page sent card details to the attackers as customers typed them. It ran for fifteen days and cost the airline a £20 million fine.", "occurred": "22 June – 5 September 2018", "disclosed": "6 September 2018", "people_count": 429612, "vector": "Malicious JavaScript injected into the payment page, a Magecart-style client-side skimmer", "exposed": [ "Names", "Billing addresses", "Email addresses", "Payment card numbers", "Expiry dates", "CVV security codes" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "singhealth-2018", "url": "https://www.myrecon.xyz/breaches/case-files/singhealth-2018.html", "headline": "SingHealth, 2018: 1.5 million patients, taken on the way to one of them", "subject": "SingHealth cyberattack", "description": "An advanced attacker spent months inside Singapore's largest health system, repeatedly and specifically seeking one patient's records. A million and a half others were taken en route.", "occurred": "Initial compromise around August 2017; bulk exfiltration 27 June – 4 July 2018", "disclosed": "20 July 2018", "people_count": 1500000, "vector": "A compromised front-end workstation, then lateral movement to a privileged account and queries against the electronic medical records database", "exposed": [ "Names", "National registration identity card numbers", "Addresses", "Genders", "Races", "Dates of birth", "Outpatient dispensed medicines" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 5 }, { "slug": "cambridge-analytica-2018", "url": "https://www.myrecon.xyz/breaches/case-files/cambridge-analytica-2018.html", "headline": "Cambridge Analytica, 2018: the breach that was not a breach", "subject": "Facebook and Cambridge Analytica data scandal", "description": "Data on 87 million Facebook users reached a political consultancy. Nothing was hacked. The platform handed it over through a documented feature working exactly as designed.", "occurred": "2013 – 2015, disclosed publicly in March 2018", "disclosed": "17 March 2018", "people_count": 87000000, "vector": "Legitimate use of Facebook's Graph API by a third-party app, then onward transfer of the data in breach of platform terms", "exposed": [ "Profile data", "Page likes", "Locations", "Friend lists", "Some private messages for a small subset" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "aadhaar-exposures-2018", "url": "https://www.myrecon.xyz/breaches/case-files/aadhaar-exposures-2018.html", "headline": "Aadhaar, 2018: what the reported exposures actually showed", "subject": "Aadhaar data exposure reports", "description": "Reports of Aadhaar data being sold and leaked through third-party systems were denied by the authority as breaches of its database. Both positions can be true, and that is the lesson.", "occurred": "Reported January – March 2018", "disclosed": "January 2018 onwards", "people_count": 0, "vector": "Reported unauthorised access via intermediaries, and third-party systems exposing Aadhaar numbers through unsecured interfaces", "exposed": [ "Names", "Aadhaar numbers", "Addresses and other demographic details, as reported by journalists and researchers" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "uber-2016", "url": "https://www.myrecon.xyz/breaches/case-files/uber-2016.html", "headline": "Uber, 2016: the breach that was paid to disappear", "subject": "Uber data breach and cover-up", "description": "Uber lost 57 million records, paid the attackers $100,000 through its bug bounty programme, called it a research payment, and said nothing for a year.", "occurred": "October 2016", "disclosed": "21 November 2017", "people_count": 57000000, "vector": "Credentials found in a private code repository, used to reach cloud storage", "exposed": [ "Names", "Email addresses", "Phone numbers", "600,000 US driver's licence numbers" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "equifax-2017", "url": "https://www.myrecon.xyz/breaches/case-files/equifax-2017.html", "headline": "Equifax, 2017: 147 million people, one unpatched web form", "subject": "Equifax data breach", "description": "The Equifax breach exposed 147.9 million people. A patch had been available for two months, and an expired certificate meant nobody saw the data leaving for 76 days.", "occurred": "13 May – 29 July 2017", "disclosed": "7 September 2017", "people_count": 147900000, "vector": "Unpatched Apache Struts flaw (CVE-2017-5638) in a consumer dispute portal", "exposed": [ "Names", "Social Security numbers", "Dates of birth", "Addresses", "Driver's licence numbers", "209,000 credit card numbers" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 7 }, { "slug": "notpetya-2017", "url": "https://www.myrecon.xyz/breaches/case-files/notpetya-2017.html", "headline": "NotPetya, 2017: the update that cost ten billion dollars", "subject": "NotPetya cyberattack", "description": "A backdoored update to Ukrainian tax software destroyed the networks of shipping lines, drugmakers and food companies worldwide within hours. Damage is estimated at $10 billion.", "occurred": "27 June 2017", "disclosed": "27 June 2017", "people_count": 0, "vector": "Compromised update server for M.E.Doc, Ukrainian tax accounting software, then automatic spread using EternalBlue and stolen credentials", "exposed": [], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 5 }, { "slug": "wannacry-2017", "url": "https://www.myrecon.xyz/breaches/case-files/wannacry-2017.html", "headline": "WannaCry, 2017: the patch had been available for two months", "subject": "WannaCry ransomware outbreak", "description": "A leaked intelligence-agency exploit turned ransomware into a worm that needed nobody to click anything. Microsoft had shipped the fix in March. The NHS lost 19,000 appointments in May.", "occurred": "12 May 2017", "disclosed": "12 May 2017", "people_count": 0, "vector": "The EternalBlue exploit against Microsoft's SMBv1 file-sharing protocol, leaked publicly the previous month and patched by Microsoft in March 2017", "exposed": [ "Encrypted files across hospitals, manufacturers and logistics firms", "Clinical service availability" ], "published": "2026-09-15", "updated": "2026-09-15", "reading_minutes": 5 }, { "slug": "yahoo-2013-2014", "url": "https://www.myrecon.xyz/breaches/case-files/yahoo-2013-2014.html", "headline": "Yahoo, 2013–2014: three billion accounts, and three years of silence", "subject": "Yahoo data breaches", "description": "Yahoo lost every account it had, three billion of them, in two separate intrusions, then disclosed them three years later in the middle of selling the company.", "occurred": "August 2013 and late 2014", "disclosed": "September and December 2016; revised to 3 billion in October 2017", "people_count": 3000000000, "vector": "Spear-phishing an employee, then forged authentication cookies", "exposed": [ "Names", "Email addresses", "Phone numbers", "Dates of birth", "Hashed passwords (MD5 in the 2013 set)", "Security questions and answers, some unencrypted" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 5 }, { "slug": "dropbox-2012", "url": "https://www.myrecon.xyz/breaches/case-files/dropbox-2012.html", "headline": "Dropbox, 2012: an employee reused a password, and 68 million accounts followed", "subject": "Dropbox data breach", "description": "A Dropbox employee used their LinkedIn password on a corporate account. When LinkedIn was breached, so was Dropbox, 68 million credentials, revealed four years later.", "occurred": "Mid-2012", "disclosed": "Confirmed at the time as an email exposure; full scale revealed August 2016", "people_count": 68600000, "vector": "An employee's password, stolen in the LinkedIn breach, reused on a corporate account", "exposed": [ "Email addresses", "Password hashes, about half bcrypt, about half salted SHA-1" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 3 }, { "slug": "myspace-2016", "url": "https://www.myrecon.xyz/breaches/case-files/myspace-2016.html", "headline": "MySpace, 2016: 360 million accounts from a website nobody used any more", "subject": "MySpace data breach", "description": "The MySpace passwords were years old and the site was long abandoned. That is exactly why the breach worked, abandoned accounts still hold passwords people reuse.", "occurred": "Around 2008; surfaced May 2016", "disclosed": "May 2016", "people_count": 360000000, "vector": "Never publicly detailed; passwords stored as unsalted SHA-1 of the first ten characters, lowercased", "exposed": [ "Email addresses", "Usernames", "Unsalted SHA-1 password hashes" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 3 }, { "slug": "vtech-2015", "url": "https://www.myrecon.xyz/breaches/case-files/vtech-2015.html", "headline": "VTech, 2015: six million children in a toy company's database", "subject": "VTech data breach", "description": "A breach of a children's tablet maker exposed 6.4 million child profiles, along with chat logs and photographs. The attacker's stated motive was to prove it was possible.", "occurred": "14 November 2015", "disclosed": "27 November 2015", "people_count": 6400000, "vector": "SQL injection against the Learning Lodge app store, with passwords protected only by unsalted MD5 and security answers stored in plain text", "exposed": [ "Children's names", "Dates of birth", "Genders", "Parents' names and addresses", "Email addresses", "Password hashes and plain-text security answers", "Chat logs and photographs from Kid Connect" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 5 }, { "slug": "talktalk-2015", "url": "https://www.myrecon.xyz/breaches/case-files/talktalk-2015.html", "headline": "TalkTalk, 2015: a nineteen-year-old and a webpage nobody owned", "subject": "TalkTalk data breach", "description": "TalkTalk lost 156,959 customers' data to a SQL injection attack on three webpages it had inherited in an acquisition and forgotten about. Teenagers found them.", "occurred": "15 – 21 October 2015", "disclosed": "22 October 2015", "people_count": 156959, "vector": "SQL injection against legacy webpages inherited from the Tiscali UK acquisition", "exposed": [ "Names", "Addresses", "Dates of birth", "Email addresses", "Phone numbers", "TalkTalk account information", "Bank account numbers and sort codes" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "ashley-madison-2015", "url": "https://www.myrecon.xyz/breaches/case-files/ashley-madison-2015.html", "headline": "Ashley Madison, 2015: when the data itself was the weapon", "subject": "Ashley Madison data breach", "description": "The Impact Team did not sell the Ashley Madison data. They published it, 32 million people, a paid deletion service that did not delete, and consequences measured in lives.", "occurred": "July 2015", "disclosed": "19 July 2015; data published 18–20 August 2015", "people_count": 32000000, "vector": "Never publicly established; the attackers claimed insider-level access", "exposed": [ "Names", "Email addresses", "Home addresses", "Partial card data and transaction records", "Sexual preferences stated on profiles", "bcrypt password hashes, plus a weak legacy token" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 5 }, { "slug": "opm-2015", "url": "https://www.myrecon.xyz/breaches/case-files/opm-2015.html", "headline": "OPM, 2015: 21.5 million security clearance files, fingerprints included", "subject": "US Office of Personnel Management data breach", "description": "The US government lost the background investigation files of 21.5 million people, every relationship, debt and indiscretion disclosed to get a security clearance.", "occurred": "2014 – April 2015", "disclosed": "June 2015", "people_count": 21500000, "vector": "Stolen contractor credentials, then malware providing persistent access", "exposed": [ "Names", "Social Security numbers", "Addresses", "Employment and residency history", "Foreign contacts", "Financial difficulties", "Drug use and arrests disclosed on clearance forms", "Mental health history", "Fingerprints" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "anthem-2015", "url": "https://www.myrecon.xyz/breaches/case-files/anthem-2015.html", "headline": "Anthem, 2015: 78.8 million health records and one query that looked wrong", "subject": "Anthem data breach", "description": "A database administrator noticed a query running under his own name that he had not run. Behind it were 78.8 million member records, taken over the course of a year.", "occurred": "February 2014 – January 2015", "disclosed": "4 February 2015", "people_count": 78800000, "vector": "Spear-phishing a subsidiary, then stolen credentials into a data warehouse", "exposed": [ "Names", "Dates of birth", "Social Security numbers", "Member ID numbers", "Addresses", "Email addresses", "Employment and income data" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "sony-pictures-2014", "url": "https://www.myrecon.xyz/breaches/case-files/sony-pictures-2014.html", "headline": "Sony Pictures, 2014: the breach that destroyed the computers on the way out", "subject": "Sony Pictures Entertainment hack", "description": "Attackers took everything a film studio had, emails, salaries, medical records, unreleased films, then wiped the machines and published the contents week by week.", "occurred": "November 2014", "disclosed": "24 November 2014", "people_count": 47000, "vector": "Not fully detailed publicly; the malware included a component that wiped drives", "exposed": [ "Employee names", "Social Security numbers", "Salaries", "Medical and HR records", "Internal emails", "Unreleased films" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 3 }, { "slug": "jpmorgan-2014", "url": "https://www.myrecon.xyz/breaches/case-files/jpmorgan-2014.html", "headline": "JPMorgan Chase, 2014: one server without two-factor authentication", "subject": "JPMorgan Chase data breach", "description": "A bank spending a quarter of a billion dollars a year on security lost contact data for 83 million households because a single server had been missed in an upgrade.", "occurred": "June – August 2014", "disclosed": "2 October 2014", "people_count": 83000000, "vector": "Stolen employee credentials used against a server that had not been upgraded to two-factor authentication", "exposed": [ "Names", "Addresses", "Phone numbers", "Email addresses", "Internal customer categorisation" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "home-depot-2014", "url": "https://www.myrecon.xyz/breaches/case-files/home-depot-2014.html", "headline": "Home Depot, 2014: 56 million cards through a supplier's login", "subject": "Home Depot data breach", "description": "Attackers used a third-party vendor's stolen credentials to reach Home Depot's network, then ran custom malware on self-checkout tills for five months.", "occurred": "April – September 2014", "disclosed": "8 September 2014", "people_count": 56000000, "vector": "Stolen third-party vendor credentials, privilege escalation, then memory-scraping malware on self-checkout point-of-sale terminals", "exposed": [ "Payment card numbers", "Card expiry dates", "Cardholder names", "Email addresses" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "ebay-2014", "url": "https://www.myrecon.xyz/breaches/case-files/ebay-2014.html", "headline": "eBay, 2014: 145 million users and a notice nobody saw", "subject": "eBay data breach", "description": "Attackers used a handful of employees' credentials to reach eBay's user database and sat inside for months. The company then handled the announcement about as badly as it could.", "occurred": "Late February – early March 2014, discovered in May", "disclosed": "21 May 2014", "people_count": 145000000, "vector": "Compromised credentials belonging to a small number of eBay employees, used to reach the internal network", "exposed": [ "Names", "Email addresses", "Physical addresses", "Phone numbers", "Dates of birth", "Encrypted passwords" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "morrisons-2014", "url": "https://www.myrecon.xyz/breaches/case-files/morrisons-2014.html", "headline": "Morrisons, 2014: the auditor who published the payroll", "subject": "Morrisons payroll data leak", "description": "A senior internal auditor with a grudge copied the payroll file of nearly 100,000 Morrisons staff and posted it online. The case ran to the UK Supreme Court and changed employer liability.", "occurred": "January – March 2014", "disclosed": "13 March 2014", "people_count": 99998, "vector": "Abuse of authorised access by a senior internal auditor, exfiltrated on a personal USB drive", "exposed": [ "Names", "Addresses", "Dates of birth", "National Insurance numbers", "Bank account details", "Salaries" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "target-2013", "url": "https://www.myrecon.xyz/breaches/case-files/target-2013.html", "headline": "Target, 2013: 40 million cards, and the air-conditioning contractor", "subject": "Target data breach", "description": "Attackers entered Target's network through a refrigeration contractor's stolen login, then scraped 40 million card numbers from the tills during the Christmas rush.", "occurred": "27 November – 15 December 2013", "disclosed": "18 December 2013", "people_count": 70000000, "vector": "Stolen credentials belonging to a refrigeration contractor, then memory-scraping malware on the tills", "exposed": [ "Card numbers", "Expiry dates", "CVVs from the magnetic stripe", "PINs (encrypted)", "Names", "Addresses", "Phone numbers", "Email addresses" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "adobe-2013", "url": "https://www.myrecon.xyz/breaches/case-files/adobe-2013.html", "headline": "Adobe, 2013: 153 million records and the world's worst crossword", "subject": "Adobe data breach", "description": "Adobe encrypted its passwords instead of hashing them, then stored every password hint in plain text beside them, turning the dump into a puzzle anyone could solve.", "occurred": "Discovered September 2013", "disclosed": "3 October 2013", "people_count": 153000000, "vector": "Intrusion into internal systems; source code taken alongside customer data", "exposed": [ "Email addresses", "Encrypted passwords", "Plaintext password hints", "Encrypted card numbers", "Names", "Product source code" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "linkedin-2012", "url": "https://www.myrecon.xyz/breaches/case-files/linkedin-2012.html", "headline": "LinkedIn, 2012: 6.5 million hashes that turned into 165 million accounts", "subject": "LinkedIn data breach", "description": "LinkedIn stored passwords as unsalted SHA-1. Six and a half million hashes leaked in 2012; four years later the full 165 million-account file went on sale.", "occurred": "June 2012", "disclosed": "6 June 2012; full scale revealed May 2016", "people_count": 165000000, "vector": "Never fully detailed publicly; passwords stored as unsalted SHA-1", "exposed": [ "Email addresses", "Unsalted SHA-1 password hashes" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "sony-psn-2011", "url": "https://www.myrecon.xyz/breaches/case-files/sony-psn-2011.html", "headline": "PlayStation Network, 2011: 77 million accounts and 23 days offline", "subject": "PlayStation Network outage and data breach", "description": "Sony took PlayStation Network down for 23 days after attackers took 77 million account records. The ICO later found the attack could have been prevented.", "occurred": "17 – 19 April 2011", "disclosed": "26 April 2011", "people_count": 77000000, "vector": "Intrusion into application servers running outdated, unpatched software behind an inadequately protected network boundary", "exposed": [ "Names", "Addresses", "Email addresses", "Dates of birth", "PSN login credentials", "Purchase history", "Some card details on file" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "rockyou-2009", "url": "https://www.myrecon.xyz/breaches/case-files/rockyou-2009.html", "headline": "RockYou, 2009: the 32 million plaintext passwords that became a wordlist", "subject": "RockYou data breach", "description": "A widget company stored 32 million passwords in plain text and lost them to a SQL injection. The file became the famous wordlist still used today.", "occurred": "December 2009", "disclosed": "December 2009", "people_count": 32600000, "vector": "SQL injection against an unpatched web application", "exposed": [ "Email addresses", "Passwords in plain text" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 4 }, { "slug": "heartland-2008", "url": "https://www.myrecon.xyz/breaches/case-files/heartland-2008.html", "headline": "Heartland, 2008: 130 million cards from a company that had just passed its audit", "subject": "Heartland Payment Systems data breach", "description": "Heartland was certified compliant with the card industry security standard. A SQL injection flaw let attackers plant a sniffer on the network that processed 100 million transactions a month.", "occurred": "December 2007 – 2008", "disclosed": "20 January 2009", "people_count": 130000000, "vector": "SQL injection into a corporate web application, then lateral movement and a packet sniffer on the payment network", "exposed": [ "Card numbers", "Expiry dates", "Magnetic stripe track data" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 3 }, { "slug": "tjx-2007", "url": "https://www.myrecon.xyz/breaches/case-files/tjx-2007.html", "headline": "TJX, 2007: the wireless network in the car park", "subject": "TJX Companies data breach", "description": "Attackers sat outside a Marshalls store, broke the shop's weak wireless encryption, and worked inwards until they reached the card processing systems.", "occurred": "July 2005 – December 2006", "disclosed": "January 2007", "people_count": 45700000, "vector": "Weak WEP wireless encryption at a store, then lateral movement to card processing systems", "exposed": [ "Card numbers", "Magnetic stripe track data", "Some driver's licence numbers and names" ], "published": "2026-09-14", "updated": "2026-09-14", "reading_minutes": 3 } ] }