As 2019 draws to a close, the year is ending with further news of data breaches hitting the headlines. Earlier in the year, the 2019 Midyear Quickview Data Breach Report stated that 2019 was on track to be the “worst year on record” for breach activity. With an increase of 54% in breaches over the last year and more than 4 billion records compromised, 2019 has had its share of some of the largest data breaches of all time.

Biggest Data Breaches of 2019

Fortnite

The
year started with the announcement that over 200 million gamers worldwide were
the victims of a data breach caused by multiple vulnerabilities in the online
platform, Fortnite.

On
January 16, 2019, Epic Games, creators of the Fortnite video game, declared that
a flaw in Fortnite’s login system allowed hackers to impersonate players and
purchase in-game currency using credit or debit cards on file with the account.

Epic
Games acknowledged and fixed the issue but has since been hit with a lawsuit
which alleges that the company has failed to notify affected users.

Evite

Back in February 2019, Evite, a social planning and
e-invitations service disclosed an unauthorised party acquired an inactive data
storage file holding information about the company’s users, including names,
usernames, email addresses, passwords, dates of birth, phone numbers and
mailing addresses. The breach is suspected to have impacted 100 million users.

Capital One

In March 2019, a data breach at Capital
One resulted in the exposure of 106 million customer’s
personal data. This data included names, addresses, dates of birth, credit
scores, social security numbers and bank account numbers.

A server misconfiguration was blamed for the breach, which
was classified as ‘one of the biggest data breaches ever’ and impacted around
100 million US customers and 6 million in Canada.

Verifications.io

Verifications.io, an email validation service suffered a
data breach exposing some 763 million records. The exposed data included email
address, name, gender, IP address, phone number and other personal information.
The breach was discovered by security researchers Bob Diachenko and Vinny Troia
who came across an unprotected, publicly accessible MongoDB database containing
150 gigabytes of detailed marketing data.

Canva

Canva,
a high-profile Australian web-design service experienced a database breach that
exposed the personal data of roughly 139 million users, including email
addresses, geographic locations, names, passwords, usernames, and financial
data.

Users were notified by haveibeenpwned.com (HIBP) and Firefox Monitor of the security breach that occurred on the 24th May 2019.

First American

Real estate and title insurance firm, First American accidentally exposed more than 885 million sensitive documents online when data was improperly stored and made publicly accessible.

The information, which dated back to 2003, was available
without any sort of protection and could be accessed without so much as a
password if a person knew where to look.

The digital records which included bank account numbers and
statements, mortgage and tax records, social security numbers, wire transaction
receipts, and driver’s license images were made widely available on its website
for anyone to access. Whilst there is currently no evidence to suggest the
information was found or stolen, the scale of the data breach was a treasure
trove for any scammer or identity thief and therefore very valuable.

First American said the vulnerability was a “design defect.”

Quest Diagnostics

In June, it was revealed that information belonging to up to
11.9 million Quest Diagnostics patients
had been compromised.

AMCA, a billing collections partner, was at fault when a
hacker was able to access the firm’s systems, which held sensitive bank account
information and the medical details of 11.9 million patients. The incident was
thought to have been caused by an internal supply chain security vulnerability.

Ecuador

In September, Ecuadorean officials launched an investigation
into a data breach in
which the personal data of up to 20 million people, more than the country’s
population, was made available online.

The exposed data included personal information such as full
names, dates of birth, national identity card numbers, tax identification
numbers, employment information and the names of family members. Financial
information was also leaked, including bank customers’ account status, balance,
and credit type.

The security breaches that have made the headlines this year hold valuable lessons for future data protection within organisations. The damaging after effect of a data breach can be crippling for an organisation and the threat of exposed data can strike any business at any time. For that reason, it is vital that organisations take note from previous incidents and become better at protecting their large pools of data by focusing on basic security hygiene, practices, and training.

Mitigate Human Risk

MetaCompliance specialises in
creating the best Cyber
Security awareness training available on the market. Our products directly
address the specific challenges that arise from cyber threats and corporate
governance by making it easier for users to engage in Cyber Security and
compliance. Get in touch for further
information on how we can help transform Cyber Security training within your
organisation.