Everyone makes mistakes, sooner or later. However, not every mistake results in a major cybersecurity breach that makes headlines and gets used as an example of “what not to do” for years afterward. Over the years, many companies of varying sizes have suffered cybersecurity breaches that cost them and their customers or clients dearly.
While learning from experience can be invaluable, there’s no reason to avoid learning from the experiences of others. With this thought in mind, here are a few cybersecurity breach examples that any business should learn from:
What list of data breaches would be complete without a mention of the single largest security breach on the record (at least, as of the time of this writing)? I speak, of course, of the Yahoo! data security breach. According to a CNN Business article, the “data breach at Yahoo in August 2013 affected every single customer account that existed at the time, Yahoo parent company Verizon said on Tuesday. That's three billion accounts.”
The worst part? The actual number of breached accounts was severely under-reported for years. It wasn’t until 2017 that it was found that the number of breached accounts was 3 billion—up to that point, it was assumed to be “only” 1 billion.
This news severely impacted Yahoo’s valuation during their buyout by Verizon. As noted in a CSO article, “The breaches knocked an estimated $350 million off Yahoo’s sale price. Verizon eventually paid $4.48 billion for Yahoo’s core Internet business.”
Additionally, as reported by Inc.com, because the company didn’t disclose the breach until 2016, “it has already been fined $35 million by the Securities and Exchange Commission.” Furthermore, Yahoo! (now Altbaba) and its new parent company Verizon have been made to pay out a $50 million settlement resulting from a lawsuit by users.
Unfortunately, there aren’t many details about how the attackers got in. The main lesson here is about the importance of promptly notifying customers who may have been affected by a cybersecurity breach. Because of Yahoo’s slow response, many users were affected by fraud without ever being made aware of the risk—meaning they couldn’t take the appropriate measures to protect their identities.
So, when preparing your cybersecurity architecture to protect your business with an incident response plan (IRP), it’s also important to develop strategies for thoroughly investigating a breach and notifying any and all affected parties. It also helps to consider cybersecurity insurance to help pay for identity theft protection services for your customers.
Equifax is one of three major credit bureaus operating in the U.S. to provide millions of Americans with easy access to their credit score. To generate credit scores, these bureaus need access to a wealth of information about a person, including:
It’s all too easy to see how that financial information would make credit bureaus one of the most tempting targets for attackers.
Unfortunately, Equifax suffered a major cybersecurity breach. ABC News article reported that “145.5 million Social Security numbers were compromised — representing more than 99 percent of all of the affected consumers.”
The cause of the breach? According to the ABC News article, it was an unpatched security vulnerability that was discovered prior to the security breach. Specifically, “the security hole exploited by the hackers was revealed in March 2017 but [Equifax] had failed to patch its systems.”
The primary lesson here is that it is vital to ensure that all of your business’ software and hardware are kept up to date with the latest security patches. Had Equifax applied the security patches for the exposed vulnerabilities within a month of discovering them, the data breach could have been prevented or, at least, mitigated.
Cybercriminals are often looking to compromise online storefronts. After all, these stores have a lot of attractive data that can be easily sold on the dark web or abused directly for personal profit. For example, online storefronts often hold credit card information, names, addresses, and even banking info.
So, when user accounts for these online storefronts are compromised by online attackers, there is an enormous potential for damage. EBay, the site that lets users buy and sell various products online, was hit by one such attack. As noted by The Washington Post, “Cyberattackers compromised a small number of employee log-in credentials, allowing unauthorized access to eBay's corporate network.” Using these employee log-ins, the attackers attempted to steal sensitive customer data.
However, as reported in The Washington Post article, “No financial information, including credit card numbers, were stolen.” Thankfully, relatively fast notification of affected customers gave them the chance to change their account passwords and (hopefully) avoid having their accounts abused.
While the actual method used to phish the employee user accounts is not mentioned in the Post article, the fact that it happened reinforces the need for companies to use strong authentication methods for their user accounts—such as multifactor authentication. Using stronger authentication methods could go a long way towards keeping your company becoming the next security breach example that others use to learn from.
On a more positive note, eBay’s ability to quickly notify their customers (after taking the time to investigate the full extent of the breach) may have helped to prevent some customers from experiencing account theft.
Need help improving your company’s cybersecurity posture and awareness so you can avoid suffering a major data breach? Contact the security experts at Compuquip Cybersecurity to learn more about how to protect your business and customers.