Virtually every day we see news of data breaches, which affect organizations of all types and sizes. From startups to global companies, they are subject to cyber attacks aimed at stealing (or even destroying) data. After all, the question is not “if”, but “when” an organization will fall victim to malicious attackers. And as much as vendors evolve their solutions and teams improve their cybersecurity posture, malicious actors have also been improving their attack techniques to circumvent the controls put in place. An analysis by the Identity Theft Resource Center indicated that there were 1862 data breaches in the year 2021 alone, a number 68% higher than in 2020. The segments most affected by these attacks include healthcare, finance and retail. And that number is expected to be even higher in 2022. The consequences of these attacks are not just financial: organizations are also subject to loss of reputation and trust from customers, partners, suppliers and even employees. After all, in times where data is considered the new oil, more and more people are considering the cybersecurity aspect when doing business with organizations. In recent years, millions of US user records have been publicly exposed, in many cases posted on the dark web or sold to third parties for malicious actions. For organizations, financial losses are increasing: according to IBM and the Ponemon Institute in their Cost of a Data Breach 2021 report, the average cost of a data breach was USD 4.24 million, an increase of 9 .8% compared to 2020. Continue reading this article to learn about the 8 biggest data breaches that have occurred in the United States of all time, and the consequences for users and organizations.

1. Yahoo – the data leak that occurred at the tech giant is one of the best known in the cybersecurity market. Between 2013 and 2016 a series of cyberattacks allowed Russian cybercriminals to gain access to the personal data of more than 3 billion users. These attacks earned the company a fine of USD 35 million, in addition to a few dozen lawsuits.
   
   
2. Microsoft – nearly 30,000 US companies (60,000 globally) were affected by one of the largest cyber attacks in US history. In early 2021, criminals exploited four zero-day flaws in Microsoft Exchange email servers to gain unauthorized access to users’ electronic messages. The US government has accused a cyber gang sponsored by the Chinese government of being behind the attack.
   
   
3. First American Financial Corp. – a series of flaws in the digital protection mechanisms of this large financial institution allowed approximately 885 million sensitive records to be exposed on the internet. These records included bank account numbers and their statements, as well as money transfer receipts with social security numbers and driver’s licenses. While not considered a leak, as no data was compromised, the SEC fined First American nearly $500,000.
   
   
4. Facebook – this is not the first time that Mark Zuckerberg’s social network has been involved in scandals of leaks and exposure of its users’ data. After the Cambridge Analytica episode, the names, phone numbers, usernames and passwords of 530 million users were exposed through third parties. After this episode, Facebook tightened the criteria for accessing third-party applications to its databases;
   
   
5. LinkedIn – in April 2021 malicious actors managed to exploit vulnerabilities in APIs to improperly obtain the personal data of more than 93% of the user database of the largest professional social network, which had approximately 750 million users at the time of the attack. Data such as names, phone numbers, location data and associated account details have been stolen, allowing malicious actors to misuse them to carry out phishing or ransomware attacks;
   
   
6. JP Morgan Chase – In a highly regulated industry, not even one of the largest US banks has been safe from cyber attacks. In September 2014, JP Morgan reported that cyber criminals compromised the accounts of over 76 million individuals and 7 million businesses. Fortunately, only names, emails and phone numbers were leaked, which didn’t save the giant from having to commit to spend USD 250 million annually to properly protect its customer data;
   
   
7. Home Depot – Using malware, criminals stole more than 56 million payment card records from Home Depot customers during April 2014. By 2020, the retailer had already spent over USD 180 million in damages, including damages to banks and credit card companies, in addition to paying compensation to those affected.
   
   
8. MySpace – although it no longer exists as a social network, MySpace attracts thousands of people to its site. In 2016 it was revealed that logins, names and birthdates of over 360 million users were leaked. MySpace was able to invalidate all login data and notify users, as well as having implemented stricter cybersecurity measures.

It is important to emphasize that, with the digital transformation and the increase in the use of digital media identified in recent years, there has also been a spike in the practice of cybercrime, that is, those crimes that occur through virtual means.

These crimes are usually performed by cybercriminals, who are holders of technical knowledge about internal computer systems and electronic devices, programs, and networks.

Cybercrime can occur in different ways and for different reasons. In general, users who become victims end up having their information and data stolen or their accounts hacked by criminals, which often results in episodes that can bring disastrous and immense damage to the victims.

Therefore, it is ideal to establish preventive security measures before attacks occur. There are currently many ways to ensure greater protection of your data and information.

Keep reading the article and learn more about the problem of data theft and what should be done as preventive measures.

The Biggest Data Thefts of Recent Years and the Current Cyber Scenario

We all know that cyber vulnerabilities are not a current issue. However, with the evolution of technology and virtualization growing in all areas of society, cybercrime becomes more and more frequent, creating a critical problem that deserves a lot of attention from the digital security industry. 

One of the biggest challenges is to keep up with the evolution of these crimes, because as technology advances, crimes become increasingly strategic and sophisticated, requiring even more technological advances and security efforts, in addition to repeating a cycle that is difficult to prevent.

According to data from FortiGuard Labs, the year 2020 had 41 billion attempts of cyberattacks in Latin America. The good news is that while these attempts are taking place, the cybersecurity industry has also worked hard and strengthened itself to ensure as much security as possible for digital media and to weaken this cycle of attacks.

To get a sense of the scale of this problem, here is a summary of the top 5 data thefts in recent years.

Solar Winds: The Biggest and Most Sophisticated Attack in History

In 2020, Solar Winds, an information infrastructure company, suffered what can be considered, according to Microsoft’s President Brad Smith, as “the biggest and most sophisticated attack the world has ever seen”. This is because several tactics and techniques of cyber invasion and espionage were employed. 

Cybercriminals have inserted malicious software into Solar Winds’ monitoring software update that has been sent to up to 18,000 customers. These include Microsoft companies and the US Departments of Energy, Justice, and Nuclear Safety. But it was FireEye, one of the Solar Winds’ client companies, the first victim to identify the attack. 

In the Microsoft attack alone, according to its president, at least a thousand engineers took part. Ongoing investigations indicate that the operation is very complex and surprising even for specialists, as it combines very advanced and stealthy techniques, which have bypassed the radar of the most experienced security specialists. This made everyone apprehensive about a critical vulnerability in the technology infrastructure.

Colossal DDoS Attack Against Dyn

Dyn, an American company of DNS (Domain Name System) services, has suffered a DDoS attack, which, in general, is a type of attack that intensifies data traffic and overloads a certain server, making it unavailable to users.

This attack caused a system crash for all the company’s customers in 2016, who had virtual newspapers and magazines from the United States and other large companies among them: Amazon, Netflix, PayPal, Spotify, Tumblr, Twitter, GitHub, Xbox Live, and PlayStation Network. 

It was an event known as “The American Internet Blackout”, one of the biggest DDoS attacks in recent times.

ASUS Automatic Updates

One of the largest laptop manufacturers in the world, ASUS, was the target of a cybercriminal attack in 2018, with an automatic software update that infected nearly 1 million users worldwide. 

The attack targeted 600 computers, but the malware spread and reached more users. As the attackers used the company’s legitimate security certificate during the action, it was almost impossible to raise suspicion.

This type of crime can increase users’ distrust and lead them to avoid machine upgrades, which can raise the level of vulnerabilities and cause even bigger problems. 

 STJ: Great Cyberattack in Brazil

Brazil is one of the countries with the highest number of users connected to the Internet, and according to the Internet Security Threat Report, released in 2019, the country occupies third place in the ranking of cyberattack attempts, fourth in bot attacks, and seventh in crypto-jacking.

As might be expected, government agencies are not left out of vulnerability to cybercrime. In Brazil, the biggest data attack involved the STJ (Supreme Court of Justice), a target of the ransomware action, which invaded more than 1,200 servers of the institution and destroyed the backups on the machines. 

On the scale of this attack, Marta Schuh, Director of Cyber Insurance at the international broker Marsh, stated that: “It was like the STJ databases could be placed inside an incinerator.” As expected, the criminals offered to ransom the information in exchange for a sum of money.

Leak of Sensitive Data from Over 100 Million Americans

Paige A. Thompson, a former Amazon employee, was responsible for hacking the database of Capital One, a US financial institution, compromising the data of more than 100 million Americans and 6 million Canadians by obtaining access to personal data of credit card requests. 

Although the affected information does not contain the users’ credit card numbers, as Capital One claimed, the damage will cost around $150 million to boost the institution’s digital security.

What Should Be Done to Remedy the Theft of Information and Data?

When an organization experiences a security incident, such as cybercrime, it needs to act promptly and quickly. We are not always prepared to deal with situations like these, but it is necessary to remain calm and take action.

Of course, actions should be taken according to the specific type of attack that took place and what was actually stolen or hacked into.

Therefore, carefully read the possibilities listed below on which procedures should be taken in these cases and see which ones fit best for you.

Identify the Action of the Intruders

It is important to find out how the criminal action took place and what data was disclosed. 

Thus, the procedure must take place so that the necessary measures are taken in order to restrain the results of the crime and prevent further invasions.

You can start an investigation through companies specializing in cybercrime and hard evidence.

Look for Evidence of Crime

When becoming a victim of a cybercrime, if possible, you must record the evidence of the crime.

In this sense, it is worth noting that the most correct and secure means is through specific solutions that allow the recording of all actions performed in the environment.

This can even assist in the incident remediation process, reducing operational and downtime costs.

Change Your Passwords Immediately

Another important action to be taken if you have suffered a cyberattack in which there was data theft, and also one of the ways to minimize the problem, is the immediate change of your passwords, whether for emails, networks that may be related to the theft, or for your systems.

This will prevent criminals from continuing to develop other types of damage that can be done by using your stolen data.

Check the Backup of Your Files

The use of software that backs up your information and data automatically and efficiently is a preventive measure that can help a lot in these moments.

If you have already performed this procedure, the chance of recovering your information will be much greater, so check the backup of your files and see if you can recover them.

Communicate About Information Leaks

If the information that was leaked is related to other individuals, such as employees or consumers, they must be informed about what happened and about the measures being taken about the case.

This behavior is an ethical measure, which must be carried out clearly and objectively.

Analyze the Weaknesses that Made the Invasion and Theft of Your Data Possible and Invest in Security

In addition to looking for those responsible for information leaks, it is important to recognize the limitations and deficiencies that allowed intruders access to your system.

When recognizing them, it is essential to take appropriate action so that future losses are avoided.

But What Can You Do to Prevent Data and Information Theft in Your Company?

Now that we have already talked extensively about the current cybercrime scenario involving data theft and what should be done when these incidents happen, it is time to present the main measures to prevent data theft.

One of the worst scenarios involving cyber incidents is just reacting when they happen. The best cybersecurity frameworks encourage prevention practices and the development of secure processes and projects from the beginning.

So, learn what you can do today to improve your cyber posture in the face of information theft.

Invest in Privileged Credential Management

To ensure information security, you need to develop prevention practices regularly, such as managing your company’s privileged accounts.

A solution that does not provide this function leaves the security of your information with many loopholes, which makes a cyberattack possible.

With this capability, your company can manage all active privileged credentials and confirm the privilege level of each one, verifying it is appropriate for such users to have access to certain environments, in addition to being able to revoke credentials that are no longer required, such as from former employees.

To avoid the risk of information being leaked, besides verifying access to privileged credentials, it is important to properly manage it through the automatic change of passwords.

Prioritize Strong Backups and Passwords

This practice is very simple and, at the same time, essential. Through a Privileged Access Management (PAM) solution, one can implement effective credential management and make associated passwords available to users, however, it is necessary to have some kind of guarantee that all privileged credentials have strong passwords, difficult to be broken with the use of malicious software.

The ideal is to guide the user to create a complex password that mixes upper and lower case letters, numbers, and special characters, with at least 8 characters.

In addition, the backup appears as one of the last options for data protection, which guarantees that even with leaked and/or deleted information, the company has access to all elements protected by the privileged access management solution.

Implement Two-Factor Authentication Mechanisms

The main solutions on the market require two-factor authentication from the user, usually through an OTP (One-Time Password). It is also possible to send an SMS or an email with a confirmation code for someone to be able to use the privileged credential.

This type of capability makes it difficult for unauthorized people to use the privileged user’s credentials.

The use of multifactor authentication (MFA) comes as a tool to prevent attacks from cybercriminals seeking to get hold of important information, such as credentials and passwords. MFA brings greater security to user data, through additional authentication, as well as, of course, the already known password.

Have Emergency Access

If any kind of security incident occurs that puts your company at risk, it is necessary to rely on one last capability of the security system, something like “glass breaking”. In the event of any type of failure or even a cyberattack, the person responsible for data security has the autonomy to remove privileged credentials through a dedicated backup file.

Finally, the access report is essential so that the person in charge has a broad view of the actions carried out through the privileged sessions, in order to allow the identification of security gaps and possible points for improvement.

PAM As a Way to Prevent Data Theft

A PAM solution is one of the main ways to guarantee the protection of a company’s confidential information and that all activities are tracked and audited.

Privileged Access Management, also called Privileged Identity Management, enables organizations to protect their privileged credentials. In addition, PAM ensures the effectiveness of least privilege policies by reducing attack vectors and possible data leaks.

Gartner believes that a PAM solution helps organizations securely provide privileged access to critical assets and meet compliance requirements by managing and monitoring privileged access and accounts. 

Basically, a PAM solution works as a secure credential repository for devices installed in the environment. Based on the management of user privileges, one can allow users to access only the data required for them to perform their activities. Thus, the information security team can configure user access profiles, avoiding improper access to systems and data.

Learn About the senhasegura Solution

In order to avoid data theft and traceability of actions in networks, databases, servers, and devices, senhasegura works to ensure digital sovereignty for institutions in several areas.

The solution is recommended for companies in the following scenarios:

• Companies with more than 10 users.
• Companies that received points of attention in auditing.
• Companies that must comply with cybersecurity rules and regulations.
• Companies that want to implement the best security practices.
• Companies that have suffered a security incident.
• Companies that need to reduce operating costs.

senhasegura allows companies to implement the most strict and complex controls on access to privileged credentials in an automated and centralized manner, protecting the IT infrastructure from data breaches and potential compliance breaches.

It is also ready to meet business and market compliance requirements such as LGPD, GDPR, PCI DSS, SOX, NIST, HIPAA, ISO 27001, and ISA 62443.

Did you like our article and would like to have more details? senhasegura strives to ensure the sovereignty of companies’ actions and privileged information. To do so, we work against data theft and through traceability of administrator actions on networks, servers, databases, and a multitude of devices through a PAM solution.