Equifax to Uber: Biggest data breaches and leaks that rocked the world in 2017

As cyberattacks continue to get more frequent, sophisticated and covert, 2017 saw a litany of data breaches and leaks that plagued businesses and government agencies and compromised the data of millions. Many security breaches that came to light were carried out by hackers years ago, but only came to light this year.

Other leaks were a result of human error and misconfigured cloud configurations that accidentally exposed the personal information of millions of users. In many cases, the data was handled by a third-party firm.

"Sadly, as organizations and lines of business migrate to public cloud services, IT has lost control to some degree," Varun Badhwar, CEO and co-founder of cloud threat defence RedLock told IBTimes UK. "Moreover, IT lacks the tools needed to monitor, detect and report on compliance and security issues, as the nature of securing the cloud is very different than securing on-premise data centers.

"You cannot secure what you cannot see," he continued. "We've changed the way we adopt technology. It's time we change the way new technologies are secured."

Here are some of the biggest data breaches and leaks that came to light in 2017:

Equifax:

This year, Equifax topped the list with the mother of all data breaches after disclosing that 145.5 million Americans' personal and financial data was stolen in a massive breach in July. The company said hackers exploited a months-old unpatched Apache Struts server vulnerability – a patch for which was made available a month before the cyberattack took place.

Since news broke in September, the credit firm has been bombarded with fierce scrutiny over its delayed disclosure, security practices and its handling of the breach. It has also been hit with multiple lawsuits and is facing probes by multiple states, Congress and the FBI.

Appleby:

In October, Bermuda-based law firm Appleby, whose clients include some of the world's richest people and international corporations, revealed it suffered a "data security incident" in 2016 that may be subsequently leaked.

The major data dumps, later dubbed "Paradise Papers", eventually unearthed questionable practices by a litany of notable figures including US commerce secretary Wilbur Ross, the Queen, Tory Party donor Lord Ashcroft as well as a slew of major firms such as Facebook, Apple, Twitter and Nike.

Anthem:

US health insurance giant Anthem reported another data breach in July that exposed the personal data of more than 18,000 Anthem Medicare members. One of the insurer's healthcare consulting firms discovered the one of its employees was involved in identity theft and had emailed a file containing the data of Anthem's members to his personal email account.

The file contained the Protected Health Information (PHI) of members, including their health plan ID numbers, social security numbers, dates of enrollment, Medicare contract numbers and, in some cases, dates of birth and last names.

Chipotle:

Popular Mexican fast food chain Chipotle warned customers that hackers compromised its payment systems across the US. An investigation into the intrusion found malware designed to "access payment card data from point-of-sale (PoS) devices" at most of its restaurants.

"The malware searched for track data (which sometimes has cardholder name in addition to card number, expiration date, and internal verification code) read from the magnetic stripe of a payment card as it was being routed through the POS device," Chipotle said.

InterContinental Hotels Group:

The InterContinental Hotels Group said cash registers at over 1,000 of its properties were compromised with malware designed to swipe customers' payment card data between 29 September and 29 December, 2016.

The malware targeted data on the magnetic strips of payment cards such as customers' names, card numbers, expiration dates and verification codes.

IHG, which operates over 5,000 hotels in 100 countries, said Holiday Inn, Crown Plaza, Hotel Indigo, Staybridge Suites and Candlewood Suites were affected in the breach.

Imgur:

Imgur disclosed that it suffered a major breach in 2014 that compromised the email addresses and passwords of 1.7 million user accounts. The photo-sharing site was alerted to the security incident over the Thanksgiving weekend and issued a public disclosure a day later.

"We have always encrypted your password in our database, but it may have been cracked with brute force due to an older hashing algorithm (SHA-256) that was used at the time," Imgur said.

TigerSwan:

US military contractor and global security firm TigerSwan saw thousands of files containing the sensitive and personal data of US military and intelligence personnel accidentally exposed online on an unsecured Amazon server.

Security firm Upguard discovered the Amazon Web Services S3 storage bucket that was accidentally configured for public access. Containing documents that date back to 2009, the repository listed the personal and confidential details of thousands of job applicants, many of which claimed "Top Secret" US government security clearances.

Verizon:

In another cloud storage error incident, security firm Kromtech discovered an unsecured Amazon Web Services S3 storage bucket in September that contained sensitive internal information linked to telecom giant Verizon Wireless.

This repository contained about 100MB of Verizon Wireless files and folders including internal communications, logs and servers as well as usernames and passwords that could have been used to access other parts of the firm's internal network.

In another cyber incident, UpGuard found that a third-party firm accidentally exposed the data of 6 million Verizon customers on a misconfigured AWS S3 bucket.

Uber:

Towards the end of a tumultuous year for Uber, the ride-hailing giant confirmed that a massive 2016 data breach compromised 57 million users and drivers' data across the globe. The ride-hailing giant had covered up the breach for over a year and even paid hackers a ransom of $100,000 (£75,500) to delete the stolen data and hush up the attack.

About 2.7 million people in the UK, more than half of Uber's user base in the country, were affected.

WikiLeaks' Vault 7 CIA leaks:

Since March, the whistleblowing outfit steadily published a slew of alleged confidential CIA documents exposing the spy agency's wide-ranging hacking and spying tools and capability as part of its "Vault 7" series this year.

In September, the website founded by Julian Assange released a new cache of files dubbed "Spy Files: Russia" that allegedly described how surveillance contractors in Russia operated with state authorities and stringent domestic laws using a programme called System for Operative Investigative Activities (SORM).

Last month, it leaked another batch of secret documents dubbed "Vault 8" to "enable investigative journalists, forensic experts and the general public to better identify and understand covert CIA infrastructure components."