Introduction
In 2022, the number of websites affected by cybersecurity attacks grew exponentially.
According to Check Point Research (CPR), the number of data breaches reported in 2022 was 39% higher than in 2021. Despite reaching unprecedented levels already, cyberattacks are only expected to become more frequent in 2023.
Below, we’ll document the 10 largest data breaches reported in 2022, reinforcing why every business needs an objective and adaptive cybersecurity strategy.
1. Twitter
Twitter is facing accusations of a cover-up in regards to a massive data breach that has affected millions of users in the US and EU. Cybersecurity expert Chad Loder alerted the public to the breach on November 23, 2022, stating that it occurred no earlier than 2021 and had not been previously reported. This comes after Twitter admitted to a separate data breach in July 2022 that affected millions of accounts.
2. BidenCash
An alarming data breach has exposed over 1.2 million credit card numbers on a notorious hacking forum. The carding marketplace, known as BidenCash, made the stolen information available for free on October 12, 2022. The leaked data includes credit card numbers set to expire between 2023 and 2026, as well as other sensitive details necessary for online transactions. These types of marketplaces are used for trading stolen credit card information for financial fraud, often involving significant sums of money.
3. Optus
On September 22, 2022, Australian telecom company Optus experienced a severe data breach that allowed access to the personal and medical information of 11 million people. The compromised data included names, dates of birth, phone numbers, email and home addresses, driver’s license and/or passport numbers, and Medicare ID numbers. This breach has left Optus customers at risk of identity theft and other malicious actions.
4. WhatsApp
On November 16, 2022, a hacker made a shocking announcement on the dark web: they were selling the personal information of a staggering 500 million WhatsApp users from 84 countries. The dataset, which the hacker claimed was up-to-date, included the details of 32 million US users, 11 million UK users, and 6 million German users. The hacker promised buyers “very recent mobile numbers” of WhatsApp users. This event has sparked concern and caution among the messaging app’s global user base.
5. Medibank
On October 13, 2022, Australian healthcare provider Medibank discovered suspicious activity on its internal systems. Four days later, the company was contacted by a hacker trying to “negotiate” the removal of customer data. Medibank refused to succumb to the hacker’s demands and publicly announced the data leak, which affected 9.7 million people. This incident has caused concern for Medibank’s customers and serves as a reminder of the constant threat of cyber attacks.
6. Uber & Rockstar
In the span of just one week, two major companies fell victim to a skilled hacker. On September 15, 2022, Uber’s internal servers were breached after a contractor’s device was infected with malware and their login information was sold on the dark web. The hacker then accessed additional employee accounts, giving them access to a variety of internal tools. They even took the bold step of posting a message to a company-wide Slack channel and altering Uber’s Open DNS to display a graphic image to employees on certain internal sites. This incident serves as a warning to companies to prioritize cybersecurity and the protection of their employees’ and customers’ data.
7. Twitter (again)
In July 2022, a hacker going by the name ‘devil’ announced on a hacking forum that they had obtained the data of 5.4 million Twitter accounts and were willing to sell it. The stolen information included email addresses and phone numbers from various groups of people, including celebrities and businesses. The hacker, ‘devil,’ stated that they would not accept offers below $30,000 for the database. Twitter has since confirmed that this data breach occurred and is taking steps to protect the affected accounts.
8. Nelnet Servicing
In June 2022, a devastating data breach at student loan servicer Nelnet Servicing exposed the sensitive information of over 2.5 million users. An investigation later revealed that a weakness in the system allowed a third party to access student loan account registration data, including names, addresses, phone numbers, and social security numbers, from June to July 22, 2022. This breach has caused concern for those affected and serves as a reminder of the importance of protecting personal information online.
9. Shein
In October, fast fashion brand SHEIN and its parent company, Zoetop Business Company, were hit with a $1.9 million fine by the state of New York for failing to disclose a data breach that affected 39 million customers. The breach, which occurred in July 2018, allowed a third party to gain unauthorized access to SHEIN’s payment systems. According to the New York Attorney General’s office, SHEIN’s payment processor was alerted to the issue by a credit card network and a credit card issuing bank, both of which had evidence of the infiltration and theft of card data. This fine serves as a reminder of the consequences of not properly disclosing and addressing data breaches.
10. Revolut
On September 11, 2022, a data breach at fintech start-up Revolut exposed the personal information of more than 50,000 customers. A third party was able to access Revolut’s database and obtain names, addresses, and partial payment card information for 50,150 users. While Revolut stated that complete card details were masked, the Lithuanian government confirmed that the company took swift action to stop the breach and protect its customers’ data once the incident was discovered. This event serves as a reminder of the importance of protecting personal information online.
Conculsion
The moral of the story – it’s more important than ever to invest in your businesses cybersecurity. Furthermore, your businesses security is rarely complete – new threats emerge daily and standards routinely change. Don’t wait until you’ve fallen victim to an attack; contact us today to schedule a consultation.
Get in touch with us
Secutor Cybersecurity is a trusted partner comprised of industry leading experts in the fields of Cybersecurity and Governance, Risk and Compliance. We partner with our clients to deliver on-demand solutions tailored to expertly navigate the regulatory demands of their specific industries.
Our proven track record of successfully exceeding client expectations is achieved through the combination of our methodical approach, advanced technologies, subject matter experts, and synergy with client team members.
Secutor is your team of world-class problem solvers with vast expertise and experience delivering complete solutions keeping your organization protected, audit-ready, and running smoothly.
