The biggest data breaches, hacks of 2021 | ZDNet

In 2021, thousands of new cybersecurity incidents have been recorded — and while cryptocurrency theft and data loss are now commonplace, this year stands out due to several high-profile incidents involving ransomware, supply chain attacks, and the exploitation of critical vulnerabilities.

The Identity Theft Research Center (ITRC) has reported an increase of 17% in the number of recorded data breaches during 2021 in comparison to 2020. However, an entrenched lack of transparency around the disclosure of security incidents continues to persist — and so this may be a low ball estimation. 

According to IBM, the average cost of a data breach has now reached over $4 million, while Mimecast estimates that the average ransomware demand levied against US companies is well over $6 million. The world record for the largest payout, made by an insurance company this year, now stands at $40 million.  

Read on: This is the perfect ransomware victim, according to cybercriminals | Enterprise data breach cost reached record high during COVID-19 pandemic |

Experts have warned that the security issue could persist for years with the recent emergence and rapid exploitation of the Log4j vulnerability. That goes for data leaks, breaches, and theft, too, which are unlikely to decline in number in the near future. 

Here are some of the most notable security incidents, cyberattacks, and data breaches over 2021. 

January:

• Livecoin: Following an alleged hack in December, cryptocurrency exchange Livecoin slammed its doors shut and exited the market in January. The Russian trading post claimed that threat actors were able to break in and tamper with cryptocurrency exchange rate values, leading to irreparable financial damage. 
• Microsoft Exchange Server: One of the most damaging cybersecurity incidents this year was the widespread compromise of Microsoft Exchange servers caused by a set of zero-day vulnerabilities known collectively as ProxyLogon. The Redmond giant became aware of the flaws in January and released emergency patches in March; however, the Hafnium state-sponsored threat group was joined by others for months after in attacks against unpatched systems. Tens of thousands of organizations are believed to have been compromised. 
• MeetMindful: The data of over two million users of the dating app was reportedly stolen and leaked by a hacking group. The information leaked included everything from full names to Facebook account tokens. 

February:

• SITA: An IT supplier for aviation services around the world, SITA, said a security incident involving SITA Passenger Service System servers led to the exposure of personal, identifiable information belonging to airline passengers. Airlines involved in the data breach were then required to reach out to their customers. 
• ATFS: A ransomware attack against payment processor ATFS forced multiple US cities to send out data breach notifications. The cybercriminal group which claimed responsibility, Cuba, claimed to have stolen a wide range of financial information on their leak site.  

March:

• Mimecast: Due to the Solarwinds supply chain attack disclosed in December 2020, Mimecast found itself as a recipient of a malicious software update that compromised the firm’s systems. Mimecast said that its production grid environment had been compromised, leading to the exposure and theft of source code repositories. In addition, Mimecast-issued certificates and some customer server connection datasets were also caught in the breach. 
• Tether: Tether faced an extortion demand from cyberattackers who threatened to leak documents online that would “harm the Bitcoin ecosystem.” The demand, of approximately $24 million or 500 Bitcoin (BTC), was met with deaf ears as the blockchain organization refused to pay. 
• CNA Financial: CNA Financial employees were left unable to access corporate resources and were locked out following a ransomware attack which also involved the theft of company data. The company reportedly paid a $40 million ransom.

April:

• Facebook: A data dump of information belonging to over 550 million Facebook users was published online. Facebook IDs, names, dates of birth, genders, locations, and relationship statuses were included in the logs, of which Facebook — now known as Meta — said was collected via scraping in 2019.

May: 

• Colonial Pipeline: If there was ever an example of how a cyberattack can impact the physical world, the cyberattack experienced by Colonial Pipeline is it. The fuel pipeline operator was struck by ransomware, courtesy of DarkSide, leading to fuel delivery disruption and panic buying across the United States. The company paid a ransom, but the damage was already done. 
• Omiai: The Japanese dating app said unauthorized entry may have led to the exposure of data belonging to 1.7 million users.

June:

• Volkswagen, Audi: The automakers disclosed a data breach impacting over 3.3 million customers and some prospective buyers, the majority of which were based in the United States. A finger was pointed at an associated vendor as the cause of the breach, believed to be responsible for exposing this data in an unsecured manner at “some point” between August 2019 and May 2021.
• JBS USA: The international meatpacking giant suffered a ransomware attack, attributed to the REvil ransomware group, which had such a disastrous impact on operations that the company chose to pay an $11 million ransom in return for a decryption key to restore access to its systems. 

July:

• UC San Diego Health: UC San Diego Health said employee email accounts were compromised by threat actors, leading to a wider incident in which patient, student, and employee data potentially including medical records, claims information, prescriptions, treatments, Social Security numbers, and more were exposed. 
• Guntrader.uk: The UK trading website for shotguns, rifles, and shooting equipment said that records belonging to roughly 100,000 gun owners, including their names and addresses, had been published online. As gun ownership and supply are strictly controlled in the UK, this leak has caused serious privacy and personal safety concerns. 
• Kaseya: A vulnerability in a platform developed by IT services provider Kaseya was exploited in order to hit an estimated 800 – 1500 customers, including MSPs. 

August:

• T-Mobile: T-Mobile experienced a yet-another data breach in August. According to reports, the names, addresses, Social Security numbers, driver’s licenses, IMEI and IMSI numbers, and ID information of customers were compromised. It is possible that approximately 50 million existing and prospective customers were impacted. A 21-year-old took responsibility for the hack and claimed to have stolen roughly 106GB of data from the telecoms giant. 
• Poly Network: Blockchain organization Poly Network disclosed an Ethereum smart contract hack used to steal in excess of $600 million in various cryptocurrencies.
• Liquid: Over $97 million in cryptocurrency was stolen from the Japanese cryptocurrency exchange.

September:

• Cream Finance: Decentralized finance (DeFi) organization Cream Finance reported a loss of $34 million after a vulnerability was exploited in the project’s market system.
• AP-HP: Paris’ public hospital system, AP-HP, was targeted by cyberattackers who managed to swipe the PII of individuals who took COVID-19 tests in 2020. 
• Debt-IN Consultants: The South African debt recovery firm said a cyberattack had resulted in a “significant” incident impacting client and employee information. PII, including names, contact details, salary and employment records, and debts owed, are suspected of being involved. 

October:

• Coinbase: Coinbase sent out a letter to roughly 6,000 users after detecting a “third-party campaign to gain unauthorized access to the accounts of Coinbase customers and move customer funds off the Coinbase platform.” Cryptocurrency was taken without permission from some user accounts. 
• Neiman Marcus: In October, Neiman Marcus made a data breach that occurred in May 2020 public. The intrusion was only detected in September 2021 and included the exposure and potential theft of over 3.1 million payment cards belonging to customers, although most are believed to be invalid or expired.  
• Argentina: A hacker claimed to have compromised the Argentinian government’s National Registry of Persons, thereby stealing the data of 45 million residents. The government has denied the report. 

November:

• Panasonic: The Japanese tech giant revealed a cyberattack had taken place  — a data breach occurring from June 22 to November 3, with discovery on November 11 — and admitted that information had been accessed on a file server. 
• Squid Game: The operators of a cryptocurrency jumping on the popularity of the Netflix show Squid Game (although not officially associated) crashed the value of the SQUID token in what appears to be an exit scam. The value plummeted from a peak of $2,850 to $0.003028 overnight, losing investors millions of dollars. An anti-dumping mechanism ensured that investors could not sell their tokens — and could only watch in horror as the value of the coin was destroyed. 
• Robinhood: Robinhood disclosed a data breach impacting roughly five million users of the trading app. Email addresses, names, phone numbers, and more were accessed via a customer support system. 

December:

• Bitmart: In December, Bitmart said a security breach permitted cyberattackers to steal roughly $150 million in cryptocurrency and has caused total losses, including damages, to reach $200 million.
• Log4j: A zero-day vulnerability in the Log4j Java library, a remote code execution (RCE) flaw, is now being actively exploited in the wild. The bug is known as Log4Shell and is now being weaponized by botnets, including Mirai. 
• Kronos: Kronos, an HR platform, became a victim of a ransomware attack. Some users of Kronos Private Cloud are now facing an outage that may last weeks — and just ahead of Christmas, too. 

Previous and related coverage

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0