An overview of personal data breaches in 2022
Read the original in Spanish →
More and more organizations are suffering losses of confidential information due to cyber attacks, human error or poor security practices. This can involve not only a significant economic impact, whether due to data ransom or sanctions, but also damage the company’s reputation.
It is difficult to know with certainty how many personal records are compromised each year, since the majority of published incidents do not contain that information, either because organizations are not required to report it or are simply unaware of the full scope of the attack.
Of the attacks with personal data leaks published in 2022, there are just over 480 million records violated. It represents a large decrease compared to 2021, with more than 5 billion records, of which 30% correspond to a database of the media conglomerate Comcast.
This may be due to the few thefts of large amounts of data during the past year, despite the fact that the number of attacks remains stable at just over 1,000**. Although everything indicates, as I mentioned before, that not all attacks are reported.
As an example, this list will not include the LastPass data theft that we learned about at the end of the year, even though the attack occurred in August. It could potentially involve the 33 million users of the service, but as of today there is no official data. It should be noted that the data would be encrypted and, therefore, useless for attackers.
Incidents with the highest number of stolen records
Taking everything mentioned above into account, the incidents that resulted in the highest number of stolen records in 2022 were:
- Neopets: This virtual pets website suffered a data breach on July 19 that led to the theft of source code and a database containing the personal information of more than 69 million members
- Shanghai COVID app: the personal information of 48.5 million users of a mobile health application run by the city of Shanghai was stolen
- Sriraj Hospital: Nearly 39 million health records were stolen from Bangkok’s Siriraj Hospital and offered for sale on the dark web
- Indian Railway Tourism Corporation: Dataset with names, emails and booking details of 30 million passengers put up for sale
- Customer data from a credit card company: The direct source of this theft has not been clarified, but a cybersecurity company, Hold Security, found a set of stolen data containing the names, addresses, email addresses, phone numbers, social security numbers and birth dates of nearly 23 million Americans. Analysis of the data suggests that it corresponds to current and former AT&T customers, while other sources claim that the information may have come through a credit card company.
- Pegasus Airline: A vulnerability in software developed by Turkish airline Pegasus has left 6.5 terabytes of data exposed online. The data breach, comprising 23 million files including personal information, is believed to have originated from a misconfigured Amazon AWS bucket.
- Mangatoon: Comic reading platform Mangatoon suffered a data breach that exposed information belonging to 23 million user accounts after a hacker stole it from an unsecured Elasticsearch database
- SuperVPN/GeckoVPN: A server misconfiguration caused the data of 21 million SuperVPN, GeckoVPN and ChatVPN users to be leaked
In conclusion, data breaches are a constant threat to companies and individuals around the world. It is essential that organizations take steps to protect their sensitive data, by implementing appropriate security measures and raising awareness among their employees on how to avoid falling into phishing traps and other common tactics used by cybercriminals. Additionally, it is important for businesses to maintain transparent communication with their customers in the event of a data security breach to minimize damage and restore consumer trust.
Sources:
https://nira.com/biggest-data-breaches-2022/
https://www.makeuseof.com/biggest-data-breaches-2022/
https://ermprotect.com/blog/top-10-data-breaches-so-far-in-2022/
https://www.securitymagazine.com/articles/98716-the-top-10-data-breaches-of-2022
https://www.crn.com/news/security/the-10-biggest-data-breaches-of-2022/
https://techcrunch.com/2022/12/27/badly-handled-data-breaches-2022/