Records affected: 540 million
What was compromised: phone numbers, user names, genders, and locations
Damages: leaked account information
Summary: Multiple Facebook databases were found to be unprotected by passwords or encryption, meaning anyone who searched the internet could find them. The databases cover multiple locations, including the U.S., the U.K., and Vietnam. Facebook announced in 2018 that it would make changes to "better protect people's information," yet this incident occurred in 2019, showing there were still flaws in their security systems.
Records affected: 885 million
What was compromised: bank account numbers, bank statements, mortgage and tax records, social security numbers, wire transaction receipts, and driver license images
Damages: charges from the New York State Department Financial Services (NYDFS)
Summary: This data breach was unique in the sense that there was not a breach in the company's servers, but an authentication error, meaning no authentication was required to view documents. There was a common web design error called Insecure Direct Object Reference (IDOR), which basically means that anyone who searches the direct link will have access to it. Once a single link is found, cyber criminals can use Advanced Persistent Bots (APBs) to collect and index the remaining documents. This error went undiscovered for years. The New York DFS alleges that First American failed to follow its own policies, neglecting to conduct a security review or a risk assessment of the flawed computer program.
Records affected: 21.5 million
What was compromised: Social Security numbers, fingerprints, and highly sensitive information used for background checks
Damages: extremely personal information stolen
Summary: The OPM was the victim of two cyberattacks in 2015. The first attack led to stolen government employees' information, including names, birth dates, home addresses, and social security numbers. The second led to stolen sensitive information of current, former, and prospective federal employees who had background checks. Information in background checks includes interview findings, mental health records, financial history, and other information, but there is no evidence that shows this data was impacted.
Records affected: 7 million users (potentially)
What was compromised: The entirety of Twitch's source code, three years of payout reports for creators (including high-profile creators, all of Twitch's properties (including IGDB and CurseForge), code related to proprietary SDKs and internal AWS services used by Twitch, the identity of an unreleased steam competitor from Amazon Game Studios - “Vapor”, twitch's internal 'red teaming tools', used by internal security teams for cyberattack training exercises.
Damages: 125GB of sensitive data was posted via a torrent link on the anonymous forum 4chan.
Summary: Twitch, an Amazon-owned company, had almost its entire code base compromised. The exact impact of the incidents has yet to be determined, but given the depth of compromise, it has the potential to affect all Twitch users. The security vulnerability that enabled the breach was a server configuration change that allowed unauthorized access by third parties. This has now been resolved.
Protection of an individual's information used or created using the
internet defines digital privacy. Privacy incorporates two crucial
elements-- our state of being alone and not being watched or interrupted
by others. To have digital privacy and confidentiality of all
information and data should be protected and be the core values of all
tech companies. Digital privacy also covers the protection and
expectation of having your behavior and location not tracked and that
using our digital devices can leave digital footprints.
