Top 10 most embarrassing data breaches

Inspired by a notable security gaffe at BP, we give our rundown of the most embarrassing data breaches in recent memory.

Data security

"The slurping of AT&T data on the early iPad 3G adopters by Goatse was pretty embarrassing too," Rik Ferguson, director of security research and communication at Trend Micro, told IT PRO, and indeed it was.

The hackers from Goatse Security, who claimed they were only trying to expose flaws on AT&T's side, exploited holes in AT&T servers to siphon off personal info of around 114,000 customers.

Among the possible victims were celebrities, business executives and government officials, including New York City Mayor Michael Bloomberg.

When that amount of data goes missing, it's always going to be bad for the company on the wrong end of the breach.

What made matters worse was the murkiness that surrounded the aftermath.

Daniel Spitler and Andrew Auernheimer were arrested in January, but Auernheimer, who claimed to have only publicised the flaws rather than exploit them, had already been apprehended in 2010 on drug charges.

There was plenty of back and forth between Goatse and investigators, with Auernheimer claiming his civil liberties had been "grossly violated." The Goatse member said the authorities had treated him unfairly and had even denied him a public defence lawyer.

The defendants were eventually each charged with one count of fraud and one count of conspiracy to access a computer without authorisation.

Whatever happens to the two young men, for everyone involved, the breach was one mightily unpleasant event.

4. RSA recent, mention Kaspersky

It's always bad when a security company gets hit by a cyber attack, but when it threatens the effectiveness of one of their products, then it becomes all the more humiliating.

We saw last year the impact a hack on a Kaspersky website had. In that case, hackers exploited a vulnerability in a third party app used for website admin.

Just last month, though, a much more serious hack led to a rather significant data breach. When RSA, the security arm of EMC, had its servers hacked, data on its two-factor authentication product SecurID was compromised.

The firm admitted the data could have been used to "reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack," and RSA urged customers to take immediate remedial action.

But RSA will need to take its own remedial action something that could cost the company plenty of money and time.

There are a number of questions still hanging over the breach, like how many, if any, tokens will need to be replaced?

As with many breaches, this one could turn out to be worse than initially feared. For RSA's sake, and for it's customers, let's hope not.

3. HBGary vs. Anonymous

Another security company, HBGary, was hounded by hacktivist group Anonymous and ended up looking fairly red in the face.

It all started when HBGary started going after Anonymous and tried to uncover who was running the show. When chief executive (CEO) Aaron Barr, who eventually left the firm, said he had information on those in the upper echelons of the activist organisation, Anonymous went after HBGary.

It was when Anonymous started leaking tens of thousands of emails from the firm that the embarrassment levels went up a notch. No one likes to see their dirty laundry aired in public, but that's what happened.

Details emerged on how HBGary worked with Government bodies in the US, showing how they had created malware and rootkits. Nothing truly awful emerged, but it was bad enough that the firm had its private conversations revealed to the world.

Anonymous also defaced HBGary's website and gained control over Rootkit.com, a site launched by HBGary founder Greg Hoglund, just to add to the security firm's woes.

Anyone going after Anonymous will want to ensure their security is really up to scratch, or they could suffer like HBGary has.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Cabinet Office fined £500,000 for New Year Honours data leak
data breaches

Cabinet Office fined £500,000 for New Year Honours data leak

3 Dec 2021
ICO publishes new data protection standards for the adtech industry
data protection

ICO publishes new data protection standards for the adtech industry

25 Nov 2021
Celebrity data leaked after ransomware attack on London's Graff jewellers
ransomware

Celebrity data leaked after ransomware attack on London's Graff jewellers

1 Nov 2021
ICO launches AI risk assessment toolkit for businesses
Information Commissioner

ICO launches AI risk assessment toolkit for businesses

21 Jul 2021

Most Popular

Sony pulls out of MWC 2022
Business operations

Sony pulls out of MWC 2022

14 Jan 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022