With advances in technology, cyber attacks are becoming more sophisticated and more frequent than ever before. In fact, industry experts now agree that there are two types of organizations in today’s world, those that have been breached and those that just don’t know it yet.

Over the past few years there have been a series of successful cyber attacks, compromising the personal information of millions upon millions of people. It’s no wonder why companies pour so many resources into their IT management software. Here’s a look at seven of the most high-profile cyber security breaches that have affected the most people, along with some insights as to what went wrong.

Target Corp.

While the 2008-09 breach of Heartland Payment Systems resulted in the biggest breach to date—information from some 130 million credit and debit cards was made available to cybercriminals—the 2013 breach of Target, Inc. is more well-known to the general public.

The data theft affecting Target stores nationwide was unique in that it happened in the stores themselves, not online. As for how the breach occurred, it appears that the theft of credit card and personal data began with a malware-laced phishing attack directed at employees at an HVAC firm contracted with the retailing giant. From there, the malware eventually ended up on approximately 40,000 card devices at Target store registers. Designed to steal information from the magnetic strips found on the backs of credit and debit cards as the cards are “swiped” at the point-of-sale, the breach is estimated to have affected 110 million Target shoppers. According to industry analysts, the breach could eventually cost Target Inc. as much as $1 billion. In a recent Wall Street Journal article, it stated, Target’s security woes could have been avoided had the company employed a Chief Information Security Officer (CISO).

Sony Online Entertainment Services

The Nov. 24, 2014 hijacking of Sony Pictures Entertainment’s private network is not the first of Sony’s run-ins with Cybercriminals. In April 2011, hackers who remain unknown to this day carried out a duel assault on the PlayStation Network, which links all of Sony’s home gaming consoles, and Sony Online Entertainment, which hosts online multiplayer PC games involving massive numbers of players along with Qriocity, Sony’s music and video streaming service. According to testimony given by a Purdue University professor before a Congressional committee investigating the incident, the breach was the result of Sony’s failure to use firewalls to protect its networks as well as failure to keep its Web applications fully updated.

As a result of the breach, personal data found in 102 million user accounts was comprised, including login credentials, names, addresses, phone numbers and email addresses. Despite Sony’s claims that credit card information remained safe thanks to encryption, approximately 24,000 users of SOE and Qriocity in Europe had their credit card data stolen. Thus far the clean-up costs for Sony are said to be $171 million.

JPMorgan Chase

The summer 2014 breach of JPMorgan Chase drove home the fact that financial institutions are just as vulnerable to cyberattacks as big box retailers and multi-media giants. Using a purloined list of applications and programs that run on JPMorgan’s computers, the hackers were able to verify known vulnerabilities in each program and application and then exploit those weaknesses to gain entry into the bank’s systems. All tolled, the JPMorgan breach compromised the accounts of 76 million households and 7 million small businesses. Although there were initial concerns that the breach of financial information could have meant that cybercriminals had gained access to ultra-sensitive information such as social security numbers, JPMorgan has since stated that there was no evidence that passwords and social security numbers had been compromised.

TJX Companies, Inc.

Dating back to its discovery in 2007, the TJX data breach constituted the biggest theft of customer data ever in the United States. The parent company of such popular retail brands as T.J. Maxx, Marshalls and Homegoods, TJX estimated that at least 46 million credit and debit card numbers were stolen over an 18-month period. In addition, driver’s license numbers and other “personally identifiable information” was reportedly stolen from about 450,000 TJX customers as a result of the breach.

One of the TJX hackers was Albert Gonzalez, a notorious cyber criminal who, just two years later, took part in the aforementioned Heartland Payment Systems attack. The breach is attributed to weaknesses of the Wired Equivalent Privacy security model, allowing hackers on laptops to access customer credit card numbers kept on unprotected networks. Updated estimates put the total of credit and debit card numbers stolen at 94 million, with a cost to TJX approaching $1billion dollars.

The Home Depot

In Sept. 2014, Home Depot, the hardware and building-supplies retailer, revealed that more than 56 million customer credit and debit card numbers were stolen as the result of a data breach during the summer. According to the retail giant, cyber-thieves infected point-of-sale systems in stores throughout the U.S. and Canada using malware disguised as antivirus software. In a recent Reuters report, Home Depot said that the “criminals used unique, custom-built software that had not been seen in previous attacks and was designed to evade detection.” The company further stated that the malware has since been removed from all U.S. and Canadian stores, and that U.S. stores have since implemented a new “enhanced payment protection” system for encrypting customer credit and debit card data.

Although it received less media attention than the Target breach, which happened during the Holidays of 2013, the Home Depot attack affected more people and has since cost the company $62 million and counting. The breach is also said by security experts to be the largest theft ever of credit card information from a single company.

In a recent survey of IT professionals, more than 50 per cent of them admitted that they use improper or even personal cloud storage for work use. That’s a stunning amount of un-secure network parameters! Virtually every organization has some bit of un-secure cyber property. The above breaches serve as a cautionary tale for all organizations, suggesting the need to be constantly on the lookout for new and better ways to protect sensitive corporate and customer data.

Share on LinkedIn Share with Google+
More Articles

  • Ulf Mattsson

    I agree that “With advances in technology, cyber attacks are becoming more sophisticated and more frequent than ever before” and I think that we need to rethink security and start to think like the hackers.

    A new trend is illustrated by “a recent survey of IT professionals, more than 50 per cent of them admitted that they use improper or even personal cloud storage for work use. That’s a stunning amount of un-secure network perimeters!” I think that we need to stop focusing security on the network perimeters.

    Ponemon Institute published an interesting survey related to the recent spate of high-profile cyber attacks. According to the survey database security was recommended by 49% of respondents, but the study found that organisations continue to allocate the bulk of their budget (40%) to network security and only 19% to database security. Ponemon concluded that “This is often because organisations have traditionally spent money on network security and so it is earmarked in the budget and requires no further justification.”

    I also think we need to accept that public cloud is used more and more for business data, so we urgently need better security for data in public cloud. IBM’s third annual Chief Information Security Officer (CISO) study reported “While concern over cloud security remains strong, close to 90% of respondents have adopted cloud or are currently planning cloud initiatives.”

    I found good news in a report that is addressing Cloud Security, by Gartner last month. The report analyzed solutions for Data Protection and Data Access Governance and the title of the report is “Market Guide for Data–Centric Audit and Protection.”

    The report concluded that “Organizations that have not developed data-centric security policies to coordinate management processes and security controls across data silos need to act.”

    Gartner reviewed “Cloud Encryption Gateways”, providing encryption and tokenization before the data is sent to the cloud. Cloud encryption gateways typically provide a choice of various encryption and tokenization algorithms to meet the requirements of different data sensitivity levels.

    It looks like a cloud security gateway can be an interesting option since it can proide data tokenization. Data tokenization proved to be a cost effective approach to secure the sensitive data itself across the entire data flow.Recent studies reported that data tokenization can cut security incidents by 50 % compared to alternative data protection methods, like encryption.

    I think it is time to re-think our security approach and be more data-centric.

    Ulf Mattsson, CTO Protegrity

    • Robert Cordray

      Ulf,

      Thank you for you comment. I agree with you, there’s a lot of concerns out there when it comes to IT security and we can’t be too careful when it comes down to this kind of security. Thanks again for your comment and read.

    • jakarman

      Ulf, your message is an old one but has not been heard at the C-level.
      There are a lot of security guidelines in place taker for instance the ISO27k series (former BS7799). They are intended to start with the awareness and responsibility at the C-level. As the ROI is only seen as a costfactor until …

      The need for all the damage and public hype to be happened first is a needing step before getting an reaction.

      Do not expect the cloud as the panacee for the ICT challenges. If you are not capable to understand what and how your business risks should be mitigated that question about your business is not going away when someone is running part of that. unless you are out of business.

      That is what happened to code-space (cloud based service AWS). It is missing the examples of hacks. http://www.networkworld.com/article/2366862/iaas/a-wakeup-call-for-the-cloud.html

  • Why does it seem that no matter how much security is being advertised as the best in town, the hackers are always two steps ahead and can bypass these fail-safe measures? What do they have that big corporations don’t? Are security measures being relegated into the sidelines and is not a top priority?

    • jakarman

      Yes cici, it is not top priority they are needing the facades that it ok, not the whole thing behind. Those facades are the tools, as the tools are only helpful for people doing that security job. Look what is happening there.
      They are either paranoid and blocking unnecessary business processes or most often just seen as cost factors of not much importance.

      There should be a well thought plan of possible impact possible threats and with the cost of the several applicable mitigations. Not a technical problem but a missing vision and leadership problem

  • Pete

    Currently developing SecureData GI to combat these kinds of problems http://www.secdata.com. please pay us a visit or contact me for more details.