Top 10 most embarrassing data breaches

Inspired by a notable security gaffe at BP, we give our rundown of the most embarrassing data breaches in recent memory.

"The slurping of AT&T data on the early iPad 3G adopters by Goatse was pretty embarrassing too," Rik Ferguson, director of security research and communication at Trend Micro, told IT PRO, and indeed it was.

The hackers from Goatse Security, who claimed they were only trying to expose flaws on AT&T's side, exploited holes in AT&T servers to siphon off personal info of around 114,000 customers.

Among the possible victims were celebrities, business executives and government officials, including New York City Mayor Michael Bloomberg.

When that amount of data goes missing, it's always going to be bad for the company on the wrong end of the breach.

Advertisement - Article continues below
Advertisement - Article continues below

What made matters worse was the murkiness that surrounded the aftermath.

Daniel Spitler and Andrew Auernheimer were arrested in January, but Auernheimer, who claimed to have only publicised the flaws rather than exploit them, had already been apprehended in 2010 on drug charges.

There was plenty of back and forth between Goatse and investigators, with Auernheimer claiming his civil liberties had been "grossly violated." The Goatse member said the authorities had treated him unfairly and had even denied him a public defence lawyer.

The defendants were eventually each charged with one count of fraud and one count of conspiracy to access a computer without authorisation.

Whatever happens to the two young men, for everyone involved, the breach was one mightily unpleasant event.

4. RSA recent, mention Kaspersky

Advertisement - Article continues below

It's always bad when a security company gets hit by a cyber attack, but when it threatens the effectiveness of one of their products, then it becomes all the more humiliating.

We saw last year the impact a hack on a Kaspersky website had. In that case, hackers exploited a vulnerability in a third party app used for website admin.

Just last month, though, a much more serious hack led to a rather significant data breach. When RSA, the security arm of EMC, had its servers hacked, data on its two-factor authentication product SecurID was compromised.

The firm admitted the data could have been used to "reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack," and RSA urged customers to take immediate remedial action.

Advertisement - Article continues below

But RSA will need to take its own remedial action something that could cost the company plenty of money and time.

There are a number of questions still hanging over the breach, like how many, if any, tokens will need to be replaced?

Advertisement - Article continues below

As with many breaches, this one could turn out to be worse than initially feared. For RSA's sake, and for it's customers, let's hope not.

3. HBGary vs. Anonymous

Another security company, HBGary, was hounded by hacktivist group Anonymous and ended up looking fairly red in the face.

It all started when HBGary started going after Anonymous and tried to uncover who was running the show. When chief executive (CEO) Aaron Barr, who eventually left the firm, said he had information on those in the upper echelons of the activist organisation, Anonymous went after HBGary.

It was when Anonymous started leaking tens of thousands of emails from the firm that the embarrassment levels went up a notch. No one likes to see their dirty laundry aired in public, but that's what happened.

Details emerged on how HBGary worked with Government bodies in the US, showing how they had created malware and rootkits. Nothing truly awful emerged, but it was bad enough that the firm had its private conversations revealed to the world.

Advertisement - Article continues below

Anonymous also defaced HBGary's website and gained control over, a site launched by HBGary founder Greg Hoglund, just to add to the security firm's woes.

Anyone going after Anonymous will want to ensure their security is really up to scratch, or they could suffer like HBGary has.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now

Most Popular

data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Microsoft Windows

Memes and Viking funerals: The internet reacts to the death of Windows 7

14 Jan 2020
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020