Over a billion people’s data was compromised in 2018

From credit card skimming to bugs and ‘leaky’ backends, we will review the most significant and worst data breaches the world faced in 2018.

380,000 transactions made between August 21st and September 5th were compromised on the British Airways (BA) website and app. The attackers accessed customers’ names, addresses, emails, and payment details. The airline assured passengers that passport and travel details remained secure.

The technique used in this attack was like a digital version of ‘credit card skimming’. It allowed hackers to copy users’ information while it’s being typed into a data entry form. Such attacks tend to target companies that have poor security.

In this case, hackers found a loophole in BA’s booking page, injected malicious code, and instantaneously sent customer data to their own server. The attack didn’t involve hackers penetrating the servers, which is why they only managed to gather the information over a very specific time frame and why they got data not normally stored by the airline, like credit card CVV numbers.

A bug recently found in the Google+ platform gave third-party developers access to 500,000 accounts, which included users’ full names, birth dates, genders, profile photos, occupations and even places where they lived.

What’s surprising is that the bug wasn’t noticed for three years. Eventually, when Google found it and patched it, they decided not to inform the public because they feared another scandal just like Cambridge Analytica. Google says that 438 apps had access to sensitive information, but that there’s no evidence that developers misused this data.

Unlike other social media platforms, Google+ struggled to get new users. With the latest data leak, they decided that it’s now time to shut down the platform completely.

Ticket Fly, an event ticketing website, was hacked by a cybercriminal calling himself IsHaKdZ who stole the data from 27 million accounts. The hacker broke into Ticket Fly’s systems and replaced its homepage with an image from the ‘V for Vendetta’ film depicting the fictional British Anarchist who protests and fights the fascist government.

He then asked Ticket fly for a one bitcoin ransom and warned them that their security is poor threatening to publish the database after his next attack. However, even though the hack disrupted many events taking place in the US, the company refused to speak to the hacker or pay the ransom.

The hacker never released the data publicly, but Washington Post journalists spoke to the hacker and confirmed that the data was authentic. Despite the havoc, the website was back up and running in about a week.

This revolutionary taxi company isn’t immune to hacking either. In November 2016, hackers accessed Uber’s cloud servers and downloaded the data of almost 35 million users, including their full names, phone numbers, email addresses and the locations where they first signed up for the service.

If this happened two years ago, why are we talking about this now? Because Uber brushed it under the carpet and failed to notify its customers (and the 3.7 million drivers whose trip summaries, weekly payments, and even driver’s license numbers were also exposed). Instead, Uber paid the hacker a $100,000 ransom, called it a ‘bug bounty,’ and waited for a year to start monitoring the affected accounts.

Lack of communication with their users and failing to follow the procedures of the ‘bug bounty reward scheme’ resulted in Uber receiving a hefty fine of $148m in the US £385,000 in the UK. Director of Investigations at Information Commissioner's Office UK, Steve Eckersley said:

“This was not only a serious failure of data security on Uber's part, but a complete disregard for the customers and drivers whose personal information was stolen. At the time, no steps were taken to inform anyone affected by the breach, or to offer help and support. That left them vulnerable. Paying the attackers and then keeping quiet about it afterwards was not, in our view, an appropriate response to the cyber attack.”

– Steve Eckersley, ICO Director of Investigations

Of course, no ‘naughty’ list this year would be complete without Facebook.

Cambridge Analytica, a British political consulting firm, were given permission to use more than 50 million Facebook profiles for “research purposes.” However, they instead collected user information to create psychographic profiles to influence the US presidential campaign in 2016. This data mining and data analysis company was employed by Donald Trump and helped him shape and predict the votes.

In September, the social media giant hit the headlines once again as they compromised the security of almost 90 million users. A bug in Facebook’s ‘View As’ feature was discovered that could be used to steal users’ access tokens, which keep the user logged into a website or an app during a browsing session.

Access tokens do not save the user’s password, so Facebook logged out everyone potentially affected to restore the security. However, hackers still managed to steal usernames, genders, and information about their hometowns.

Facebook claims that, so far, it hasn’t noticed any suspicious behavior on compromised accounts. However, this doesn’t mean that this data won’t be used at a later date.

As if this wasn’t enough to lose trust in Facebook, another bug was announced only a few days ago. It appears that hundreds of third-party apps had unauthorized access to 7 million users’ photos. Worst of all, these included pictures people might have started uploading but never posted.

It’s unknown whether anyone had seen these photos or used them in any malicious way. However, it shows once more how much data Facebook collects and how little control they have over their cybersecurity.

“A lot of people who are worried about privacy and those kinds of issues will take any minor misstep that we make and turn it into as big a deal as possible. We realize that people will probably criticize us for this for a long time, but we just believe that this is the right thing to do.”

– Mark Zuckerberg, CEO of Facebook

A company that can test people’s DNA to find their ancestors and build their family trees leaked the email addresses and hashed passwords of over 92 million users. The attack was noticed in June when the company’s security researcher found their users’ data sitting in a private server that doesn’t belong to the company.

My Heritage stated that the most sensitive user data, such as their DNA info and family trees, is stored on separate systems that weren’t compromised.

Secure your internet traffic with a top-notch VPN!

The question-and-answer website Quora was recently hacked and put 100 million users at risk. Quora representatives said they’d noticed that ‘a malicious third party’ had accessed sensitive information on Quora’s database. These cybercriminals gained access to nearly everything, from users’ names and IP addresses to their Q&A history, access tokens, and private messages.

Quora claimed that none of their partners’ financial information or any anonymous Q&A’s had been affected. The attack is under investigation, and no further comments have been made by the company.

Firebase, a Google-owned development platform, leaked the sensitive information of over 100 million users. The platform might not be well known to everyone, but it’s widely used by mobile developers.

Appthority researchers scanned 2.7 million iOS and Android apps that connect to and store their data on Firebase. They found that over 3,000 of those apps were connected to a misconfigured database that could be accessed by anyone.

These apps with ‘leaky backends’ had been downloaded on the Google Play Store over 620 million times and could have exposed highly sensitive data, including user IDs, plaintext passwords, users’ locations, bank details, bitcoin transactions, social media accounts, and even health records.

Google was notified of the ‘leaky’ apps and their backends.

At the beginning of the year, My Fitness Pal, a food and nutrition app owned by Under Armour, leaked the data of 150 million users. Once the company noticed the breach, they notified their users in almost record time(compared to other companies) – 4 days.

The company confirmed that hackers got hold of usernames, email addresses and hashed passwords. My Fitness Pal stated that other information, such as credit card numbers, wasn’t compromised because it was stored separately from generic user information.

It’s unknown how hackers broke into the systems, but Under Armour is working with data security firms to investigate the attack and take precautionary measures to avoid similar break-ins in the future.

Twitter rarely makes the headlines when it comes to data breaches, but this year was different. A security bug exposed 330 million users’ passwords, all in plain text.

Twitter stated that there was an issue with their password hashing system. It failed to encrypt passwords and was saving them in plain text. Their investigators claimed that no one had actually accessed the data, but if any of the affected accounts had been hacked, their passwords would have been visible to the attacker. Their information could then be used to access other accounts.

Twitter has advised a number of users to change their passwords as a precautionary measure. The bug has now been fixed.

The biggest data breach of the year (if not ever) exposed the data of half a billion users. Marriott said that hackers broke into its booking system and accessed customer data for the last four years. This major data breach affected the following Starwood properties: St. Regis, Westin, Sheraton, Aloft, Le Meridien, Four Points, and W Hotels. Marriott’s hotel databases are separate and haven’t been compromised.

Cybercriminals stole Starwood’s customers’ names, addresses, phone numbers, card numbers, passport numbers and even the information of where and who they were traveling with.

Because this information wasn’t used for any known financial gains or identity thefts, there are rumors that this could’ve been a state-sponsored attack. A former British intelligence officer said that the aim of this attack could’ve been to get valuable information on spies, diplomats and military officials who’ve stayed in Marriott hotels over the years. It’s strange that the attack remained unnoticed for such a long time and that none of the information was monetized.

The scope of these attacks shows that even the biggest corporations are vulnerable and are prone to errors. This means that it’s becoming more difficult to trust them as we never know when our data is going to end in the wrong hands. Unfortunately, we have little to no control over when the next company will be hacked, but we can take a few precautionary steps to protect our data:

• Create a strong and unique password or use this strong random password generator.
• Use this tool to regularly check if your password has been breached.
• Think twice before posting anything on social media. This information can be used against you.
• If you shop online, use a credit card. You will have less liability for fraudulent charges if your financial information leaks.
• Provide companies only with necessary information. The less information they have, the less they can leak.
• Look out for fraud. If notified that your data was leaked, change your passwords and take the steps advised by the company that compromised your data.