“If you put a key under the mat for the cops, a burglar can find it, too. Criminals are using every technology tool at their disposal to hack into people’s accounts. If they know there’s a key hidden somewhere, they won’t stop until they find it.” – Tim Cook, CEO of Apple Inc.

The entire digital landscape has evolved into a behemoth of sorts as the number of online attacks targeting individuals, businesses, and governments has risen steadily. And it’s not just money and cryptocurrencies they’re after. Customer or user data has evolved into a powerful tool for businesses to make crucial decisions, which has attracted the attention of cyber criminals all over. 
As they continue to get more frequent and sophisticated, cyber attacks ranging from data breaches to account takeovers (ATOs) cost the global economy over $8 Trillion in 2023. Data theft has emerged as the leading problem with far-reaching consequences.

The 2023 IBM Cost Of A Data Breach report revealed that a data breach classified as ‘High Risk’ could cost a company over $4 Million. The Healthcare sector emerged as the most impacted, where the average cost of a data breach stood at around $10 Million. However, industry experts argue that reputational damage hurts organizations even more, especially publicly listed companies.

Hackers and malicious actors are continuously devising new ways to steal sensitive data that can be sold or used as bait for ransom.

With such towering repercussions, aren’t enterprises equipped with the latest solutions to combat these threats effectively? The answer – not quite Below are some of the biggest data breaches that cost companies millions in the form of compensation, litigation, and reputational damage and regulatory scrutiny.

1. Progress Software

Date: June, 2023

The MOVEit episode at Progress Software was a zero-day vulnerability that affected some of the biggest organizations across the globe. Having originated from Progress’ file transfer application named MOVEit Transfer, the breach exposed the data of over 90 million users spread across 2,500 institutions, which has run up costs and liabilities to >$15 Billion. 
The notorious cybercriminal syndicate Clop claimed responsibility for the attack in 2023. Some notable victims of this breach include the US Department of Energy, First National Bank, John Hopkins University, and the NYC Department of Education.

2. T-Mobile

Date: January, 2023

Due to its vast and distributed IT ecosystem, T-Mobile employs dozens of microservices that interact with each other and share sensitive data. With hundreds of APIs in use, the scope of API abuse increases exponentially. As a result, the telecom provider has suffered over five different data breaches in the last three years alone. 

The latest cybersecurity gaffe came in January 2023, where a single compromised API exposed the sensitive data of over 37 million customers. Even though T-Mobile assured customers that no sensitive information was leaked, hackers can use this information to launch phishing scams and credential-stuffing attacks. 

Still reeling from the 2021 data breach that led to $350 Million in payouts, T-Mobile’s cybersecurity woes continue to mount. 

3. MGM Resorts International

Date: Oct, 2023

MGM Grand’s casino services were dealt a blow in 2023 as a ransomware attack aimed at the company disrupted operations in real time. Carried out by a subsidiary faction of the ALPHV ransomware gang, the group carried out an elaborate vishing scam where hundreds of employees were bombarded with calls aimed at extracting login credentials. Using the obtained credentials, the group deployed its ransomware to take control of their systems. 

In the wake of this exposure, MGM had to shell out over $10 Million to resolve the breach. Furthermore, widespread disruptions across its slot machines, ATMs, online reservation portals, and PoS machines resulted in a quarterly net loss of over $100 Million  for MGM Resorts International.

4. Microsoft

Date: January, 2021

In 2021, cyber-criminal syndicate Hafnium launched a sweeping attack on the Microsoft Exchange email servers and gained access to emails belonging to 60,000+ businesses, government bodies, and enterprises. By exploiting four different zero-day vulnerabilities, the hackers were able to break in and deploy malware, create backdoors to access other internal systems, and ultimately take control of the servers. 

The incident is often referred to as the single largest cyber attack on US soil, as over half of the affected 60,000 entities were from the United States. Even though Microsoft was able to initiate remediation efforts by patching server vulnerabilities, those that haven’t upgraded their servers remain at risk.

5. First American Financial Corporation

Date: May, 2019

Although the First American Financial Corporation incident was classified as a data leak and not a breach (because data wasn’t exploited), the episode highlights the threat and risks associated with poor data security measures. 

Caused by a website design error known as Insecure Direct Object Reference (IDOR), access to private and sensitive information was granted without authentication or authorization procedures. In the end, over 885 million file records containing information such as bank account numbers, bank statements, social security numbers, and wire transfer receipts were leaked. For ignoring red flags and violating established cybersecurity laws, First American Financial Corp. was slapped with a $500,000 fine by the Securities and Exchange Commission (SEC).

These are just a handful of the prominent data exposures recorded in history. What frightens experts is that most cyberattacks go unrecorded or undetected for years. And when discovered, it’s often too late! While the Fortune 500s may recover from malicious penetrations, data theft could mean the end of SMEs as the financial toll on them will be too high. 

Organizations must constantly monitor and enhance their cybersecurity measures at all times as the transmission of sensitive information such as social security numbers, financial records, personal health data, and Personally Identifiable Information (PII) via web applications and APIs continues to rise. 

The ideal API and App cybersecurity solution for businesses is as follows:

– Cloud-native and platform-agnostic for seamless integration across applications and microservices

– Capable of protecting APIs & web applications across the entire ecosystem regardless of protocols

– Able to assess weaknesses and automate remediation to protect your systems against further breaches

Check out Wallarm’s comprehensive solution that helps you detect and block attacks in real time significantly reducing costs.

The post Top 5 Data Breaches That Cost Millions appeared first on Wallarm.

*** This is a Security Bloggers Network syndicated blog from Wallarm authored by wlrmblog. Read the original post at: https://lab.wallarm.com/top-5-data-breaches-that-costed-millions/