Sensitive personal information, including full names, addresses, dates of birth, gender information, and Social Security Numbers. The breach was caused by the exploitation of vulnerabilities in Cleo’s file transfer software, including flaws that allowed unauthorized file uploads/downloads and command execution. An unauthorized third party accessed data through a compromised LexisNexis GitHub account on a third-party software development platform.
Quantas identified suspicious activity relating to a third-party contact center platform. They confirmed that a cyber incident occurred, exposing customer information. The Quantas Airways data breach resulted in stolen data posted on the dark web. DoorDash, the popular app for ordering food and groceries, disclosed a recent data breach. The company’s response claims that there is no indication that any fraud or identity theft have occurred. The best way to avoid those is using multi-factor authentication (MFA), using VPNs, and ensuring employees understand cybersecurity best practices.
Passwords were either in plaintext or hashed with SHA-1 in lowercase without salting, which is trivially crackable, and the dump included roughly 15 million accounts that users believed they had deleted. The company had already been breached in 2015, exposing 3.5 million users’ sexual preferences, so this was a repeat failure at an organization holding some of the most sensitive personal data imaginable. In 2023, DNA testing company 23andMe came under fire after hackers leaked and sold detailed genetic information along with identity data.
We’re proud the Data Breach Chronology has found its way into research programs around the world. Privacy Rights Clearinghouse has been tracking breaches for twenty years and educating consumers about their rights for more than thirty. The Data Breach Chronology exists because of the researchers, journalists, and organizations who support it.
It also demonstrates that an entity takes their responsibility to protect personal information seriously, which is integral to building and maintaining trust in an entity’s personal information handling capability. Credit bureaus handle extremely sensitive personal information, which makes them a frequent target of data hacks. While many companies do a good job of protecting their consumers, one organization that failed to prepare and respond properly was Equifax. The 2017 personal data breach affected citizens in the United States, the United Kingdom, and Canada. For example, hackers might steal the email account passwords of corporate executives and use those accounts to conduct business email compromise scams.
The incident, which TransUnion claims was quickly contained, did not compromise its core credit database or credit reports, but it exposed sensitive personal data. The breach is reportedly part of a wider campaign of attacks targeting companies that use Salesforce, a third-party cloud-based service, by a well-known hacking group. The most common and harmful privacy breach occurs when a malicious party breaches an organization’s security to access consumer information. By targeting major companies, hackers and other data thieves gain access to hundreds of thousands of private consumer records with a single attack. Often stolen information includes addresses, financial information, and personal identification data. Hackers targeted cybersecurity firm Okta in October with the firm initially downplaying the incident, saying it only impacted 130 customers or 1% of its userbase.
We need a strong, federal privacy law and ban on online behavioral advertising to eliminate the incentives driving companies to keep surveilling us online. Indirect notification must be given by public communication or similar measure that could reasonably be expected to reach the affected individuals. To put it simply – there must be a record of every breach of security safeguards. In so doing, the principal organization will need to ensure there are sufficient contractual arrangements in place with the processor to address compliance with the breach provisions set out in PIPEDA. Therefore in this context, we find it reasonable to interpret the principal organization as having control of the personal information and therefore responsibility for breach reporting in respect of a breach that occurs with the third party processor.
The 5 Most Important Lessons For Companies From The 2025 Data Breaches
- The breach was a result of a ransomware attack by a cybercriminal group that not only encrypted systems but also exfiltrated a large volume of sensitive data, which it later began leaking on the dark web.
- Or these websites could install viruses onto your computer, or steal any passwords you enter.
- In essence, your Cybertruck became the star of its own Keeping Up With My Cybertruck reality show, except the audience wasn’t made up of fans interested in your lifestyle, just random people with access to the internet.
- Finance researchers are studying whether ESG scores or CEO characteristics predict breach vulnerability.
The US has ranked most expensive in the world for 15 consecutive years, and healthcare remains the costliest sector at $7.42 million per breach. That gap, roughly 2.3 times the global figure, is the practical reason US organizations can’t treat breach economics as an abstract risk. Conduent only stated that the disruptions were caused by a “cybersecurity incident.” They haven’t provided details about the specific attack vector. Over 882,000 individuals’ personal and health information was compromised, representing a significant exposure of sensitive patient data. Over 3.3 million individuals’ personal information was compromised, indicating a large-scale exposure of sensitive data. A massive 2.7 billion records were exposed in this data breach, highlighting the sheer volume of compromised data.
Inotiv Pharma Firm Suffers Ransomware Breach
A breach on online marketplace eBay between late February and early March 2014 exposed sensitive personal information of an estimated 145 million user accounts. Cybercriminals gained access to eBay’s systems after compromising a small number of employee login credentials. Experian subsidiary Court Ventures fell victim in 2013 when a Vietnamese man tricked it into giving him access to a database containing 200 million personal records by posing as a private investigator from Singapore. In March 2014, he pleaded guilty to multiple charges including identity fraud in the US District Court for the District of New Hampshire. The DoJ stated at the time that Ngo had made a total of $2 million from selling personal data. For transparency, this list has been calculated by the number of users impacted, records exposed, or accounts affected.
This is Under Armour’s second major exposure, following the 2018 MyFitnessPal breach that affected around 150 million accounts, which is why the incident attracted disproportionate regulatory attention. These are not breaches of any single organization, and they appear here specifically because they are routinely and wrongly presented as such. RockYou2024 was a 9.9 billion line password file that was overwhelmingly a re-aggregation of older lists.
EFF has worked tirelessly to raise the alarm on this sort of software, and this year worked with AV Comparatives to https://thewingtalks.com/ test the stalkerware detection rate on Android of various major antivirus apps. Unfortunately, there is growing political interest in mandating identity or age verification before allowing people to access social media or adult material. EFF and others oppose these plans because they threaten both speech and privacy.
KrebsOnSecurity revealed that First American, the second largest title insurer in the United States, had been publishing hundreds of millions of scanned real estate closing documents on its website in a way that required no login at all. Changing a single digit in a document URL returned somebody else’s financial paperwork. The flaw required no attacker sophistication, which is precisely why the case is cited so often, and the exposure ran for roughly 16 years before an outside journalist reported it.
One hundred forty-seven million US records, 15 million UK records, and 19,000 Canadian records were stolen in the breach. The Equifax breach is an instance of a privacy breach example in Canada and ranks as one of the largest data breaches in the world. The through line across four decades of incidents is that scale rarely comes from sophistication. That shifts the defensive priority from your own perimeter to the security posture of every vendor, contractor, and connected application you rely on.
Change Healthcare is the largest US healthcare breach by a wide margin, affecting 192.7 million individuals after three upward revisions, and it surpassed the 2015 Anthem breach that had held the record for nine years. The through-line across two decades of major breaches is that visibility precedes prevention. The single most damaging breach of the US federal government exposed the most intimate documents the government holds on its own people. SF-86 forms are compiled specifically to identify anything that could be used for blackmail, and 21.5 million of them were taken by a foreign intelligence service, along with fingerprints that can never be reissued. Every clearance holder, their spouses and their foreign contacts were exposed. That decision produced the first criminal conviction of a US security executive for breach concealment.
Some states make notification letters public, while others provide only summary data. The “meticulously gathered and maintained” database offered comprehensive behavioral, economic, and social profiles of the vast majority of the Chinese population. Researchers believe that one collection, named “tw_db” contains Taiwan-related details.
Attackers broke into roughly 14,000 accounts using recycled passwords and then leveraged the DNA Relatives feature to harvest profile data on 6.9 million people who had never had their own accounts compromised. Datasets specifically targeting people of Ashkenazi Jewish and Chinese descent were advertised for sale, which turned the incident into an ethnic targeting concern rather than a conventional identity theft case. 23andMe initially blamed customers for password reuse and changed its terms of service to restrict class actions, both of which drew heavy criticism. An API sitting on the public internet with no authentication allowed an attacker to walk Optus’s customer database.
The Genea Fertility Clinic data breach in February 2025 resulted from a sophisticated cyberattack by the “Termite” ransomware gang. This incident compromised highly sensitive patient data, including personally identifiable information and detailed medical records. The stolen data included names, addresses, and other contact information, although the company has stated that no financial details, passwords, or transaction history were accessed. In August 2025, the company confirmed a data breach at an independently owned franchise in Lansing, Michigan, which occurred in late 2024. The incident, attributed to the RansomHub ransomware group, exposed a significant amount of sensitive data. Manpower clarified that the attack was isolated to the franchise’s network and did not affect ManpowerGroup’s wider corporate systems, and the company has offered complimentary credit monitoring to those affected.
Patients, customers, and employees alike are finding themselves caught in the fallout of ransomware attacks and data theft that hit healthcare systems, tech platforms, and even global retailers. From McLaren Health Care and Kettering Health to Zoomcar and Ahold Delhaize, the impact has been widespread, touching everyday lives in ways that go far beyond technology. These stories remind us that behind every breach are real people whose trust and privacy are on the line. Data breaches have exposed the personal information of hundreds of millions of people across the U.S., affecting individuals, businesses, and entire industries – and in many cases many times over.
US authorities charged four named members of the Chinese military with masterminding the hack. Dubsmash acknowledged the breach and sale of information had occurred and provided advice around password changing. However, it failed to state how the attackers got in or confirm how many users were affected. The 631GB database — which also included phone numbers, home addresses, and behavioral profiles — was left wide open on the internet, unprotected by a password or any other form of authentication control.
Ascension, one of the largest nonprofit healthcare systems in the United States, operates over 140 hospitals and 40 senior care facilities across 19 states, focusing on patient-centered care. In May 2025, Ascension disclosed a significant data breach involving third-party vendors, exposing sensitive patient information ideal for medical identity theft. The breach, primarily linked to a former business partner’s outdated software and a compromised cloud system, highlighted vulnerabilities in vendor security practices, impacting hundreds of thousands of individuals. July 2025 was another sobering reminder of just how vulnerable even the biggest brands, governments, and service providers remain in the face of cyber threats. From global airlines and fast-food giants to luxury fashion houses and city governments, organizations across industries found themselves grappling with breaches that exposed millions of records, disrupted critical operations, and shook customer trust. What stands out this month is not only the scale of these incidents, but also the common threads—social engineering, supply chain weaknesses, and basic security oversights—that continue to enable attackers.