Top 10 most embarrassing data breaches

Inspired by a notable security gaffe at BP, we give our rundown of the most embarrassing data breaches in recent memory.

"The slurping of AT&T data on the early iPad 3G adopters by Goatse was pretty embarrassing too," Rik Ferguson, director of security research and communication at Trend Micro, told IT PRO, and indeed it was.

The hackers from Goatse Security, who claimed they were only trying to expose flaws on AT&T's side, exploited holes in AT&T servers to siphon off personal info of around 114,000 customers.

Among the possible victims were celebrities, business executives and government officials, including New York City Mayor Michael Bloomberg.

When that amount of data goes missing, it's always going to be bad for the company on the wrong end of the breach.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

What made matters worse was the murkiness that surrounded the aftermath.

Daniel Spitler and Andrew Auernheimer were arrested in January, but Auernheimer, who claimed to have only publicised the flaws rather than exploit them, had already been apprehended in 2010 on drug charges.

There was plenty of back and forth between Goatse and investigators, with Auernheimer claiming his civil liberties had been "grossly violated." The Goatse member said the authorities had treated him unfairly and had even denied him a public defence lawyer.

The defendants were eventually each charged with one count of fraud and one count of conspiracy to access a computer without authorisation.

Whatever happens to the two young men, for everyone involved, the breach was one mightily unpleasant event.

4. RSA recent, mention Kaspersky

Advertisement - Article continues below

It's always bad when a security company gets hit by a cyber attack, but when it threatens the effectiveness of one of their products, then it becomes all the more humiliating.

We saw last year the impact a hack on a Kaspersky website had. In that case, hackers exploited a vulnerability in a third party app used for website admin.

Just last month, though, a much more serious hack led to a rather significant data breach. When RSA, the security arm of EMC, had its servers hacked, data on its two-factor authentication product SecurID was compromised.

The firm admitted the data could have been used to "reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack," and RSA urged customers to take immediate remedial action.

Advertisement
Advertisement - Article continues below

But RSA will need to take its own remedial action something that could cost the company plenty of money and time.

There are a number of questions still hanging over the breach, like how many, if any, tokens will need to be replaced?

Advertisement - Article continues below

As with many breaches, this one could turn out to be worse than initially feared. For RSA's sake, and for it's customers, let's hope not.

3. HBGary vs. Anonymous

Another security company, HBGary, was hounded by hacktivist group Anonymous and ended up looking fairly red in the face.

It all started when HBGary started going after Anonymous and tried to uncover who was running the show. When chief executive (CEO) Aaron Barr, who eventually left the firm, said he had information on those in the upper echelons of the activist organisation, Anonymous went after HBGary.

It was when Anonymous started leaking tens of thousands of emails from the firm that the embarrassment levels went up a notch. No one likes to see their dirty laundry aired in public, but that's what happened.

Details emerged on how HBGary worked with Government bodies in the US, showing how they had created malware and rootkits. Nothing truly awful emerged, but it was bad enough that the firm had its private conversations revealed to the world.

Advertisement - Article continues below

Anonymous also defaced HBGary's website and gained control over Rootkit.com, a site launched by HBGary founder Greg Hoglund, just to add to the security firm's woes.

Anyone going after Anonymous will want to ensure their security is really up to scratch, or they could suffer like HBGary has.

Featured Resources

The essential guide to cloud-based backup and disaster recovery

Support business continuity by building a holistic emergency plan

Download now

Trends in modern data protection

A comprehensive view of the data protection landscape

Download now

How do vulnerabilities get into software?

90% of security incidents result from exploits against defects in software

Download now

Delivering the future of work - now

The CIO’s guide to building the unified digital workspace for today’s hybrid and multi-cloud strategies.

Download now
Advertisement

Most Popular

Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/cloud/amazon-web-services-aws/354223/what-to-expect-from-aws-reinvent-2019
Amazon Web Services (AWS)

What to expect from AWS Re:Invent 2019

29 Nov 2019
Visit/hardware/354232/raspberry-pi-4-owners-complain-of-broken-wi-fi-when-using-hdmi
Hardware

Raspberry Pi 4 owners complain of broken Wi-Fi when using HDMI

29 Nov 2019
Visit/mobile/google-android/354189/samsung-galaxy-a90-5g-review-simply-the-best-value-5g-phone
Google Android

Samsung Galaxy A90 5G review: Simply the best value 5G phone

22 Nov 2019