IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

The worst hacks of all time

Yahoo, LinkedIn, Facebook, here is a quick guide to some of the biggest data breaches in history

Yahoo! sign on top of a gray building

Data breaches have become all too common. Not a week goes by without news of some company or organization learning they cyber criminals have hacked them. 

The breaches often compromise people's Social Security numbers, bank account numbers, email and physical addresses, credit cards, and other data. Such data theft leaves people open to issues such as identity theft.

Here are some of the worst hacks of all time.

1. Yahoo

Number of people affected: 3 billion

By far the worst hack of all time happened to Yahoo in 2013 when hackers compromised around 3 billion people’s data. 

At the time, the figure was reported as just 500 million, still enough to make it the biggest hack in history. However, it would be another four years before Yahoo admitted the figure was closer to 3 billion. 

The hacked data included names, email addresses, phone numbers, dates of birth, encrypted passwords, and unencrypted security questions. 

The person responsible for the hack was Karim Baratov. He was later given five years in prison and had to pay the victims restitution and $2.25 million in fines. For its part, Yahoo had to pay out $50 million in damages and offer free credit monitoring services to millions of its users.

2. Marriott

Number of people affected: 383 million

The Starwood group of hotels, which includes Sheraton, W Hotels, Westin, Le Meridien, Four Points by Sheraton, Aloft, and St. Regis, had been compromised sometime in 2014. This was before the Marriott Hotel group acquired it in 2016. It wasn’t until 2018 that Marriot found evidence of a breach through an internal investigation. 

This meant for four years, the company had been the victim of a hacking campaign on Starwood’s reservation system. Cyber criminals exploited an unpatched vulnerability to hack the system.

While it was initially thought the hack affected 500 million people, this final number was 383 million. The hackers stole names, addresses, phone numbers, credit card information, email addresses, and unencrypted passport numbers.

The UK’s Information Commissioner’s Office (ICO) fined the Marriott chain £99 million ($135.95 million). The ICO said that Marriott  ``failed to undertake sufficient due diligence" during the acquisition and missed the vulnerability as a result. 

3. Facebook

Number of people affected: 533 million

Related Resource

HP Wolf Security: Threat insights report

Equipping security teams with the knowledge to combat emerging threats

Skyscrapers from belowFree download

In April 2021, a hacker published 533 million users’ details on a low-level hacking forum. The data contained phone numbers, Facebook IDs, full names, previous locations, birth dates, relationship status, and biographies. It also includes some of their email addresses.

Facebook said the issue stemmed from a vulnerability it patched in 2019, so technically, the data was scraped from the website. 

Alon Gal, chief technology officer of cyber crime intelligence company Hudson Rock, said in a tweet the data would still be of interest to cyber criminals. 

4. LinkedIn

Number of people affected:  500 million

The scraped data of over 500 million LinkedIn profiles was put up for sale on a popular hacker forum in April 2021. The The hacker had already leaked two million records as proof of the existence of the much larger data treasure trove, according to reports by Cybernews

The data included  LinkedIn IDs, full names, email addresses, phone numbers, genders, links to LinkedIn profiles, and professional titles.

A spokesperson for LinkedIn said the posted data appeared to “include publicly viewable information that was scraped from LinkedIn combined with data aggregated from other websites or companies.”

5. Equifax

Number of people affected: 143 million

In 2017, Equifax disclosed personal information of more than 145 million people was compromised. While the breach was big, what stood out was the quality of the data hackers harvested.

In addition to full names, dates of birth, and addresses, some victims also had drivers' license numbers, credit card information, and Social Security numbers stolen.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Mastering endpoint security implementation
Security

Mastering endpoint security implementation

18 May 2022
The Total Economic Impact™ of Apple Mac in Enterprise: M1 update
Whitepaper

The Total Economic Impact™ of Apple Mac in Enterprise: M1 update

12 May 2022
Dell Technologies World 2022: Dell unveils fastest storage architecture in company history
Server & storage

Dell Technologies World 2022: Dell unveils fastest storage architecture in company history

4 May 2022
Dell Technologies World 2022: Dell unveils security offerings for major cloud providers
public cloud

Dell Technologies World 2022: Dell unveils security offerings for major cloud providers

3 May 2022

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Google Russia files for bankruptcy, ends operations in the country
Business operations

Google Russia files for bankruptcy, ends operations in the country

19 May 2022