# data[].attributes.body
Carl Neely Jr

# data[].attributes.attachment_link.readable_text
TechTarget defines a data breach as "an incident in which sensitive, protected, or confidential data has potentially been viewed, stolen, or used by an individual unauthorized to do so. Data breaches may involve payment card information (PCI), personal health information (PHI), personally identifiable information (PII), trade secrets, or intellectual property." But how long have data breaches been a concern for companies and consumers, and what kind of impact have data breaches had throughout history?

The Origin of Data Breaches

Data breaches have gained widespread attention as businesses of all sizes become increasingly reliant on digital data, cloud computing, and workforce mobility. With sensitive business data stored on local machines, on enterprise databases, and on cloud servers, breaching a company's data has become as simple - or as complex - as gaining access to restricted networks.

But data breaches didn't begin when companies began storing their protected data digitally. In fact, data breaches have existed for as long as individuals and companies have maintained records and stored private information. Before computing became commonplace, a data breach could be something as simple as viewing an individual's medical file without authorization or finding sensitive documents that weren't properly disposed of. Still, publicly-disclosed data breaches increased in frequency in the 1980s, and in the 1990s and early 2000s, public awareness of the potential for data breaches began to rise.

Laws and regulations such as HIPAA or the PCI Data Security Standard are created to provide guidelines for companies and organizations handling certain types of sensitive consumer information. These regulations provide a framework for the required safeguards, storage, and use practices for handling sensitive information. But these rules don't exist in all industries, nor do they definitively stop data breaches from occurring.

Most information on data breaches focuses on the time period from 2005 to today. This is largely due to the advancement of technology and proliferation of electronic data throughout the world, making data breaches a top concern for both enterprises and consumers. Today's data breaches can impact hundreds of thousands - often millions - of individual consumers, and even more individual records, all from a single attack on one company.

How Many Data Breaches Occur?

The Privacy Rights Clearinghouse, which reports on data breaches impacting consumers, maintains a chronology of data breaches and security breaches dating back to 2005. The data breaches reported by the Privacy Rights Clearinghouse include breaches in which the information compromised "includes data elements useful to identity thieves, such as Social Security numbers, account numbers, and driver's license numbers."

However, some breaches that do not compromise this type of sensitive information are also reported in order to provide a broad view of the variety and frequency of data breaches. Additionally, the data breaches reported here include only those reported in the United States, not incidents in other countries.

Most Historical Accounts Document Breaches from 2005 Onward

While data breaches were certainly occurring prior to 2005, most of the biggest data breaches recorded in history are reported in 2005 or beyond. This can be attributed to the fact that the world's volume of data has been growing exponentially year after year, giving cyber criminals a greater opportunity to expose massive volumes of data in a single breach.

Image via CSC.com.

Consider these projections from a 2012 report by CSC:

By 2020, over one-third of all data will live in or pass through the cloud.

In 2020, data production is estimated to be 44 times greater than it was in 2009; experts estimate a 4,300 percent increase in annual data generation by 2020.

While individuals are responsible for most data creation (70 percent), 80 percent of all data is stored by enterprises.

In 2005 alone, 136 data breaches were reported by the Privacy Rights Clearinghouse. More than 4,500 data breaches have been made public since 2005, with more than 816 million individual records breached. In actuality, this number is much higher, as the total number of records breached reported by the Privacy Rights Clearinghouse includes breach reports for which the number of records breached is unknown. Additionally, the Privacy Rights Clearinghouse is not a comprehensive compilation of all breach data, so the actual total records breached as a result of data breaches is likely substantially higher. For instance, the 2015 Verizon Data Breach Investigations Report covered over 2,100 data breaches in which more than 700 million records were exposed for the year 2014 alone.

Data Breaches Have Become Larger in Number and Impact

Several experts and other media outlets have attempted to name the largest data breaches in history. According to Statista, which reports on the number of data breaches and records exposed in the United States since 2005, the number of cyber attacks is on an upward trend. In 2005, for instance, 157 data breaches were reported in the U.S., with 66.9 million records exposed. In 2014, 783 data breaches were reported, with at least 85.61 million total records exposed, representing an increase of nearly 500 percent over 2005. And those are Statista's numbers, which are somewhat conservative when compared to the Verizon DBIR or other industry-standard data breach reports.

Image via Statista.com.

The trend is not consistently on an uphill slope, however. In 2009, for example, the number of total data breaches reported in the U.S. dropped to 498, from 656 in 2008. That said, the total number of individual records exposed increased sharply, from 35.7 million in 2008 to 222.5 million in 2009. These figures indicate that while fewer breaches occurred, the individual breaches were larger, resulting in a greater number of records exposed per breach.

There was also a decline in the number of data breaches reported between 2010 and 2011, with 662 data breaches reported in 2010, and 419 data breaches reported in 2011. Since 2011, however, the number of data breaches reported in the United States has been rising steadily:

447 data breaches reported in 2012

614 data breaches reported in 2013

783 data breaches reported in 2014

Forbes reports that over the past 10 years, there have been more than 300 data breaches resulting in the theft of 100,000 or more records. And that's just some of the data breaches that were publicly reported.

The Largest Data Breach in History

Interestingly, the largest data breach in history indirectly involved Experian, one of the three main credit reporting agencies. Experian acquired a company called Court Ventures, which gathers and aggregates information from public records, in March 2012. At the time of acquisition, Court Ventures had a contract with a company called U.S. Info Search, enabling customers of U.S. Info Search to access U.S. Info Search's data to find individuals' addresses to determine which court records to review.

Court Ventures sold information to a number of third parties, including a "Vietnamese fraudster service," which then provided its own customers with the opportunity to look up personal information of Americans, including financial information and Social Security numbers, which was then used for identity theft in many cases.

As Experian explains, "After Experian's acquisition of Court Ventures, the U.S. Secret Service notified us that Court Ventures had been and was continuing to resell data from a U.S. Info Search database to a third party, possibly engaged in illegal activity. The suspect in this case posed as a legitimate business owner and obtained access to U.S. Info Search data through Court Ventures prior to the time Experian acquired the company." Experian maintains that no Experian databases were breached; U.S. Info Search's databases were the source of the consumer information.

Some news sources cite 200 million records breached in this incident, which continued for more than 10 months after Experian acquired Court Ventures, although DataBreaches.net reports that 200 million is the figure representing the total number of records stored in the database that was breached. The actual number of records exposed, according to Experian, is unknown, but believed to be much lower.

Other Major Data Breaches

While the Experian/Court Ventures incident is often cited as the largest data breach in history, there are certainly many other data breaches that have gained widespread recognition as having substantial impact, or at minimum, threat of potential impact, on consumers.

In 2008 and 2009, Heartland Payment Systems suffered a data breach resulting in the compromise of 130 million records. A New Jersey-based payment processor, Heartland Payment Systems' data was breached through malware that was planted on Heartland's network, recording credit card data as it arrived from retailers, Tom's Guide reports. This data, obtained through Heartland's payment processing services for more than 250,000 businesses, was then exposed to cybercriminals. This data breach is regarded as the largest credit card scam in history.

Slate.com visualizes the largest data breaches in history, with data since 2005, in an infographic that illustrates whether breaches were the result of hacks, accidental publication, inside jobs, lost or stolen computers, lost or stolen media, poor security, viruses, or unknown causes.

Image via Slate.com.

The majority of the largest breaches recorded result from hacking attacks, while one of the earliest reported data breaches, impacting AOL and compromising 92 million records in 2005, is reported as an inside job. Another AOL breach, in 2006, resulted from accidental publishing of sensitive data; this breach compromised 20 million records.

A data breach impacting the U.S. military is another notable exception to the rule, with 76 million records compromised in 2009 as the result of lost or stolen media. Other notable major data breaches not previously discussed include:

Among these major data breaches are a multitude of other breaches affecting companies of all sizes, with varying levels of impact. This data, particularly in light of the fact that most of these breaches are carried out by hackers, illustrates that data breaches are becoming more widespread - and having a much larger impact, compromising millions of records containing sensitive consumer, company, or user data.

With even the world's largest companies suffering massive data breaches impacting millions of consumers, modern enterprises require a comprehensive, full-circle approach to data protection and security. The reactive approaches of yesterday simply don't cut it in the modern threat landscape.

Data Breach Defense and Prevention Resources

With the ever-increasing number of data breaches and increased threats to security - enterprise, small business, and personal security alike - data breach defense and prevention has advanced accordingly, offering greater protections and a more proactive approach to security to ensure the safety of sensitive information. The following resources offer additional information on the advancement of data protection, as well as valuable tips for preventing data breaches.

Members of the U.S. House of Representatives House Energy and Commerce Committee have advanced a bill that addresses the increased threat of cyber crime to consumers. "The Data Security and Breach Notification Act is a bipartisan solution to address the growing problem of cyber crimes and protect vulnerable information from criminals. The legislation establishes a nationwide safety regime for data protection and breach notification."

Verizon's annual Data Breach Investigations Report has become a security industry favorite for its assessments of thousands of data breaches that were investigated by Verizon, the U.S. Secret Service, and several partnering security organizations. Every year the DBIR sets out to analyze major trends in data breaches, victims being targeted, attack patterns, and more.

DataLossDB is an open source, community-maintained research project that covers publicly-disclosed data breaches across the globe. The site provides details around data loss incidents as well as analysis of historical data breach trends.

IT Business Edge provides a slideshow illustrating 8 Ways to Prevent Data Breaches, including tips such as instituting end user security awareness, performing regular vulnerability assessments, and other helpful tactics.

Data Breach Today is a multi-media news resource and a robust source of information on the latest data breaches, their impact, and strategies for preventing your company from falling victim to cyber criminals.

Data Breach Watch is another resource reporting on discovered data breaches, news, and trends impacting both consumers and companies in every vertical.

The Global Privacy & Security Compliance Law Blog is an excellent resource for companies faced with stringent and ever-changing security regulations and compliance requirements.

The Hill takes a critical look at data breach prevention practices in light of the alarming statistics on the number of data breaches and their subsequent fallouts in 2014. As this article points out, the number of data breaches that involved 100 million customer records or more doubled in 2014. In fact, one billion data records were either lost or stolen in 2014, a 71 percent increase over 2013. "It's time that executives and information security professionals accept the fact that their companies will be breached and start thinking outside the box when it comes to data security. To be in denial of this truth is to not accept reality."

This article from The New York Times discusses strategies for minimizing the risk of a data breach in light of the major breaches impacting some of the world's largest companies in recent history. One suggestion, for instance, is minimizing or eliminating the unnecessary storage of data. "Companies also need to think carefully about what data they are collecting and storing. By keeping lots of sensitive information, they place themselves and their customers at considerable - and in some cases unnecessarily greater - risk than if they had deleted the data or never collected it. To take one startling example, security experts say there was absolutely no reason for Target to have stored the four-digit personal identification numbers, or PINs, of their customers' debit cards."

Tom's IT Pro reports on new tools and technologies for preventing data breaches following the 2014 SecureWorld Expo.

While no company wants to suffer a data breach, healthcare providers and their business associates stand to lose even more from a data breach, with penalties under HIPAA for inadequately protecting personal health information. CIO takes a look at the risks of a data breach in the healthcare industry, offering 12 tips to prevent a healthcare data breach.

According to this article from TechTarget, "Assumption of breach is the new norm." The article goes on to describe how this critical shift in thinking is being used to create more stringent, comprehensive data breach protection policies and protocols.

As many of these sources point out, 2014 was a record-breaking year for data breaches, renewing the focus on the need for better methods for both preventing and responding to the (inevitable) data breach. This 60-minute webinar training from Bank Info Security discusses " The Changing Landscape of Data Breaches & Consumer Protection in 2015." The full webinar will be available on-demand soon.

Experian, itself subjected to the perils of the aftermath of a data breach, has released its second annual Data Breach Industry Forecast for 2015. The report provides an overview of data breach trends and the outlook for 2015, and also emphasizes the need for companies to have a data breach response plan.

Holland & Knight takes a look at " How Recent Data Breaches are Changing the Face of Cybersecurity for the Private Sector."

We at Digital Guardian regularly cover the topic of data breaches and provide insights on both preventing and responding to a data breach. In this expert roundup, we ask 30 data security experts to share the most important next step you should take following a data breach. In another roundup, we asked 27 data security experts for their insights on the most cost-effective ways startups can protect themselves from data breaches. Be sure to follow our blog for updates on the latest data security information, research, and discussions, and visit our resources section for analyst reports, case studies, data sheets, and other resources on data breach prevention and data security.

As the wave of data breaches continues to roll on, we take a look back at some of the largest and most damaging data breaches on record. Read on for a historical walk through breaches over time as well as resources for preventing data breaches.

# data[].attributes.attachment_link.description
As the wave of data breaches continues to roll on, we take a look back at some of the largest and most damaging data breaches on record. Read on for a historical walk through breaches over time as well as resources for preventing data breaches.

# data[].attributes.attachment_link.readable_text
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese.

On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households. That included customer names, addresses, phone numbers and email contact information. In addition, the breach affected about seven million of J.P. Morgan's small businesses customers. Overall, it may have been the biggest cyber attack in corporate history.

Here's a look at some of the biggest breaches at some top companies.

Even Walmart, the top company in this year's Fortune 500 list, hasn't been immune to cybersecurity breaches. According to an investigation by Wired in 2009, hackers broke into the computer system used by the company's (wmt) development team to steal information from cash registers. That data then found its way onto a computer in Eastern Europe.

Unlike other more recent breaches, Wal-Mart was not required to discuss the breach publicly, according to Wired, because the company called it an "internal issue."

In 2009, Wal-Mart's Chief Privacy Officer said the company was doing its best to "segregate the data, to make separate networks" and to "encrypt it fully" to safeguard from future data hacks.

Photograph by Kevork Djansezian-Getty Images

Home Depot (hd) may be your first stop for home improvement needs. But earlier this year, it fell victim to cyberthieves who stole up to 60 million card numbers. The attacks went on for five months before they were discovered. In September, the company said that anyone who used a credit card to shop in the U.S. or Canada over a six month period earlier this year could have been a victim.

At the time, Home Depot CEO Frank Blake called security a "major issue" and tried to reassure customers by saying the retailer had bolstered its lines of defense.

ALBANY, CA - MAY 15: A shopping cart stands in the parking lot of a Target store May 15, 2006 in Albany, California. Target announced a 12 percent rise in profit in its quarterly earnings report, falling short of market expectations. Target stock closed at $50.02, down $2.19. (Photo by Justin Sullivan/Getty Images) Photograph by Justin Sullivan-Getty Images

During last year's holiday season, there was little to cheer about for Target (tgt) shoppers. That's because of a massive security breach in which hackers accessed personal information about as many as 110 million consumers. The aftershocks are still reverberating for Target nearly a year later. In August, Target said the costs associated with the hacking added up to $148 million.

Photo by Spencer Platt-Getty Images

In one of the tech industry's racier scandals of 2014, hackers broke into the iCloud accounts of a number of Hollywood celebrities and made off with nude photos. Celebrities targeted included Jennifer Lawrence of "Hunger Games" fame, model Kate Upton and actress Kirsten Dunst. At the time, Apple (aapl) released a statement saying the breach wasn't system-wide, but rather due to specifically targeting the celebrity accounts. "None of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud or Find my iPhone," according to a statement. The timing, however, wasn't the best for the company, with its announcement of the new iPhone 6 phones slated for a few weeks later.

Photograph by Joe Raedle-Getty Images

Retailer Neiman Marcus suffered a cyber attack in February in which they culprits accessed the company's customer credit card records. In rifling through the database, the hackers set off 60,000 alerts that notified the retailer of questionable activity. But staff didn't pay much attention. For eight months, the hackers remained undetected and able to access information from cash registers, according to a Businessweek investigation. Originally, Neiman Marcus believed about 1.1 million customer cards were in danger. But the most recent estimate is 350,000, with about 9,000 cards used fraudulently, according to the company.

# data[].attributes.attachment_link.title
5 huge cybersecurity breaches at big companies

# data[].attributes.attachment_link.description
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese. On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households.

# data[].attributes.headline
Yahoo CEO Loses Bonus Over Security Lapses

# data[].attributes.subject
Yahoo CEO Loses Bonus Over Security Lapses

# data[].attributes.body
Tracey Russell

# data[].attributes.attachment_link.title
Yahoo CEO Loses Bonus Over Security Lapses

# data[].attributes.headline
Target Data Breach Spilled Info On As Many As 70 Million Customers

# data[].attributes.subject
Target Data Breach Spilled Info On As Many As 70 Million Customers

# data[].attributes.body
Elicia Jones

# data[].attributes.attachment_link.readable_text
The data breach that was the nightmare before Christmas for Target and its millions of customers just got a little bit worse: the retailer said Friday morning that the information stolen between November 27 and December 15, 2013 included personal information of as many as 70 million people -- more than the 40 million the company originally estimated.

On December 19, the retailer said that as many as 40 million credit card and debit card accounts may have been compromised during Black Friday weekend through December 15, and that information stolen included customer names, credit or debit card number, the card's expiration date and CVV (card verification value). Now, in an update on the hacking investigation, Target said that an additional 70 million people were affected, and the stolen customer information includes names, mailing addresses, phone numbers and email addresses. Target said that much of this data is "partial in nature," but it will nonetheless provide one year of free credit monitoring and identity theft protection to all guests who shopped at its U.S. stores.

"I know that it is frustrating for our guests to learn that this information was taken and we are truly sorry they are having to endure this," Gregg Steinhafel, Target's chairman, president and CEO said in a statement Friday morning. "I also want our guests to know that understanding and sharing the facts related to this incident is important to me and the entire Target team."

As a result of the incident, Target is lowering its fourth quarter 2013 earnings guidance, saying that it expects fourth quarter earnings to fall in the range of $1.20 to $1.30 per share, down from the previously announced $1.50 to $1.60 per-share range. The retailer also adjusted its sales outlook, now saying that it expects a comparable sales decline of 2.5%, versus its prior guidance of flat comparable sales. Target said this expectation includes "meaningfully weaker-than-expected sales since the announcement, which have shown improvement in the last several days" and a comparable sales decline of 2% to 6% for the period in the quarter following the announcement of the data breach.

At this time, the retailer said, it is not able to estimate the full cost to the company related to the data breach. However, costs may include liabilities to payment card networks for reimbursements of credit card fraud and card reissuance costs, liabilities related to REDcard (its store credit card) fraud and card re-issuance, liabilities from civil litigation, governmental investigations and enforcement proceedings, expenses for legal, investigative and consulting fees, and incremental expenses and capital investments for remediation activities. All of these costs could affect Target's fourth quarter 2013 results and beyond.

Target will announce its full fourth quarter results on February 26, 2014.

Following the update on the number of customers affected and the lowered fourth quarter guidance, shares of Target dipped 1.5% in pre-market trading. Since the announcement of the data breach on December 19, shares of the company are up just 1.9%; the retailer finished 2013 with just a 7.6% gain.

# data[].attributes.attachment_link.title
Target Data Breach Spilled Info On As Many As 70 Million Customers

# data[].attributes.attachment_link.description
The data breach that was the nightmare before Christmas for Target and its millions of customers just got a little bit worse: the retailer said Friday morning that the information stolen between November 27 and December 15, 2013 included personal information of as many as 70 million people -- more than the 40 million the company originally estimated.

# data[].attributes.headline
Fast Food Chain Arby’s Acknowledges Breach

# data[].attributes.subject
Fast Food Chain Arby’s Acknowledges Breach

# data[].attributes.body
Brett Arsenault

# data[].attributes.attachment_link.readable_text
Sources at nearly a half-dozen banks and credit unions independently reached out over the past 48 hours to inquire if I'd heard anything about a data breach at Arby's fast-food restaurants. Asked about the rumors, Arby's told KrebsOnSecurity that it recently remediated a breach involving malicious software installed on payment card systems at hundreds of its restaurant locations nationwide.

A spokesperson for Atlanta, Ga.-based Arby's said the company was first notified by industry partners in mid-January about a breach at some stores, but that it had not gone public about the incident at the request of the FBI.

"Arby's Restaurant Group, Inc. (ARG) was recently provided with information that prompted it to launch an investigation of its payment card systems," the company said in a written statement provided to KrebsOnSecurity.

"Upon learning of the incident, ARG immediately notified law enforcement and enlisted the expertise of leading security experts, including Mandiant," their statement continued. "While the investigation is ongoing, ARG quickly took measures to contain this incident and eradicate the malware from systems at restaurants that were impacted."

Arby's said the breach involved malware placed on payment systems inside Arby's corporate stores, and that Arby's franchised restaurant locations were not impacted.

Arby's has more than 3,330 stores in the United States, and roughly one-third of those are corporate-owned. The remaining stores are franchises. However, this distinction is likely to be lost on Arby's customers until the company releases more information about individual restaurant locations affected by the breach.

"Although there are over 1,000 corporate Arby's restaurants, not all of the corporate restaurants were affected," said Christopher Fuller, Arby's senior vice president of communications. "But this is the most important point: That we have fully contained and eradicated the malware that was on our point-of-sale systems."

The first clues about a possible breach at the sandwich chain came in a non-public alert issued by PSCU, a service organization that serves more than 800 credit unions.

The alert sent to PSCU member banks advised that PSCU had just received very long lists of compromised card numbers from both Visa and MasterCard. The alerts stated that a breach at an unnamed retailer compromised more than 355,000 credit and debit cards issued by PCSU member banks.

"PSCU believes the alerts are associated with a large fast food restaurant chain, yet to be announced to the public," reads the alert, which was sent only to PSCU member banks.

Arby's declined to say how long the malware was thought to have stolen credit and debit card data from infected corporate payment systems. But the PSCU notice said the breach is estimated to have occurred between Oct. 25, 2016 and January 19, 2017.

Such a large alert from the card associations is generally a sign of a sizable nationwide breach, as this is likely just the first of many alerts Visa and MasterCard will send to card-issuing banks regarding accounts that were compromised in the intrusion. If history is any lesson, some financial institutions will respond by re-issuing thousands of customer cards, while other (likely larger) institutions will focus on managing fraud losses on the compromised cards.

The breach at Arby's comes as many credit unions and smaller banks are still feeling the financial pain from fraud related to a similar breach at the fast food chain Wendy's. KrebsOnSecurity broke the news of that breach in January 2016, but the company didn't announce it had fully removed the malware from its systems until May 2016. But two months after that the company was forced to admit that many Wendy's locations were still compromised.

B. Dan Berger, president and CEO of the National Association of Federal Credit Unions, said the number of cards that PSCU told member banks were likely exposed in this breach is roughly in line with the numbers released not long after news of the Wendy's breach broke.

"Hundreds of thousands of cards is a big number, and with the Wendy's breach, the alerts we were getting from Visa and MasterCard were in the six-digit ranges for sure," Berger said. "That's probably one of the biggest numbers I've heard."

Berger said the Wendy's breach was especially painful because the company was re-compromised after it scrubbed its payment systems of malicious software. Many banks and credit unions ended up re-issuing customer cards several times throughout last year after loyal Wendy's customers re-compromised their brand new cards again and again because they routinely ate at multiple Wendy's locations throughout the month.

"We had institutions that stopped approving debit and credit transactions through Wendy's when they were still dealing with that breach," Berger said. "Our member credit unions were eating the costs of fraud on compromised cards, and on top of that having to re-issue the same cards over and over."

Point-of-sale malware has driven most of the major retail industry credit card breaches over the past two years, including intrusions at Target and Home Depot, as well as breaches at a slew of point-of-sale vendors. The malware sometimes is installed via hacked remote administration tools like LogMeIn; in other cases the malware is relayed via "spear-phishing" attacks that target company employees. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.

Thieves can then sell that data to crooks who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to purchase high-priced electronics and gift cards from big-box stores like Target and Best Buy.

Readers should remember that they're not liable for fraudulent charges on their credit or debit cards, but they still have to report the unauthorized transactions. There is no substitute for keeping a close eye on your card statements. Also, consider using credit cards instead of debit cards; having your checking account emptied of cash while your bank sorts out the situation can be a hassle and lead to secondary problems (bounced checks, for instance).

Tags: Arby's breach, Arby's Restaurant Group breach, Christopher Fuller, Dan Berger, Mandiant, mastercard, National Association of Federal Credit Unions, PSCU, Visa

# data[].attributes.attachment_link.description
Sources at nearly a half-dozen banks and credit unions independently reached out over the past 48 hours to inquire if I'd heard anything about a data breach at Arby's fast-food restaurants. Asked about the rumors, Arby's told KrebsOnSecurity that it recently remediated a breach involving malicious software installed on payment card systems at hundreds of its restaurant locations nationwide.

# data[].attributes.headline
5 huge cyber security breaches at companies you know

# data[].attributes.subject
5 huge cyber security breaches at companies you know

# data[].attributes.body
Noah Wrightson

# data[].attributes.attachment_link.readable_text
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese.

On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households. That included customer names, addresses, phone numbers and email contact information. In addition, the breach affected about seven million of J.P. Morgan's small businesses customers. Overall, it may have been the biggest cyber attack in corporate history.

Here's a look at some of the biggest breaches at some top companies.

Even Walmart, the top company in this year's Fortune 500 list, hasn't been immune to cybersecurity breaches. According to an investigation by Wired in 2009, hackers broke into the computer system used by the company's (wmt) development team to steal information from cash registers. That data then found its way onto a computer in Eastern Europe.

Unlike other more recent breaches, Wal-Mart was not required to discuss the breach publicly, according to Wired, because the company called it an "internal issue."

In 2009, Wal-Mart's Chief Privacy Officer said the company was doing its best to "segregate the data, to make separate networks" and to "encrypt it fully" to safeguard from future data hacks.

Photograph by Kevork Djansezian-Getty Images

Home Depot (hd) may be your first stop for home improvement needs. But earlier this year, it fell victim to cyberthieves who stole up to 60 million card numbers. The attacks went on for five months before they were discovered. In September, the company said that anyone who used a credit card to shop in the U.S. or Canada over a six month period earlier this year could have been a victim.

At the time, Home Depot CEO Frank Blake called security a "major issue" and tried to reassure customers by saying the retailer had bolstered its lines of defense.

ALBANY, CA - MAY 15: A shopping cart stands in the parking lot of a Target store May 15, 2006 in Albany, California. Target announced a 12 percent rise in profit in its quarterly earnings report, falling short of market expectations. Target stock closed at $50.02, down $2.19. (Photo by Justin Sullivan/Getty Images) Photograph by Justin Sullivan-Getty Images

During last year's holiday season, there was little to cheer about for Target (tgt) shoppers. That's because of a massive security breach in which hackers accessed personal information about as many as 110 million consumers. The aftershocks are still reverberating for Target nearly a year later. In August, Target said the costs associated with the hacking added up to $148 million.

Photo by Spencer Platt-Getty Images

In one of the tech industry's racier scandals of 2014, hackers broke into the iCloud accounts of a number of Hollywood celebrities and made off with nude photos. Celebrities targeted included Jennifer Lawrence of "Hunger Games" fame, model Kate Upton and actress Kirsten Dunst. At the time, Apple (aapl) released a statement saying the breach wasn't system-wide, but rather due to specifically targeting the celebrity accounts. "None of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud or Find my iPhone," according to a statement. The timing, however, wasn't the best for the company, with its announcement of the new iPhone 6 phones slated for a few weeks later.

Photograph by Joe Raedle-Getty Images

Retailer Neiman Marcus suffered a cyber attack in February in which they culprits accessed the company's customer credit card records. In rifling through the database, the hackers set off 60,000 alerts that notified the retailer of questionable activity. But staff didn't pay much attention. For eight months, the hackers remained undetected and able to access information from cash registers, according to a Businessweek investigation. Originally, Neiman Marcus believed about 1.1 million customer cards were in danger. But the most recent estimate is 350,000, with about 9,000 cards used fraudulently, according to the company.

# data[].attributes.attachment_link.title
5 huge cybersecurity breaches at big companies

# data[].attributes.attachment_link.description
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese. On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households.

# data[].attributes.body
http://www.idtheftcenter.org/Data-Breaches/what-do-hackers-do-with-corporate-security-breaches.html
Indiea Austin

# data[].attributes.body
The article about Corporate Security Breaches that I found most interesting is titled “What to Hackers do with Corporate Security Breaches”. I’ve recently heard that credit card theft is becoming more common due to new advances in technology. But I never knew that foreign countries could obtain information in the US regarded credit card information by breaching major companies. In this article, I found out that countries like Russia that are overseas have made a business of hacking our countries customer information by breaching company’s customer information and selling it to thieves for a profit. I always wondered how credit card thefts get their someone else’s credit card and personal information. Knowing that it can be bought and sold is kind of scary.

On the website, it gives you information on how to prevent being a victim of credit card theft. They listed to always read credit card statements carefully, sign up for text alerts for all your cards if possible, and do your research on a credit card company before becoming a customer. Security breaching is real and it can happen to anyone so always be aware of making purchases and using your credit card.

http://www.idtheftcenter.org/Data-Breaches/what-do-hackers-do-with-corporate-security-breaches.html

# data[].attributes.headline
Fast Food Chain Arby's Acknowledges Breach

# data[].attributes.subject
Fast Food Chain Arby's Acknowledges Breach

# data[].attributes.body
https://krebsonsecurity.com/2017/02/fast-food-chain-arbys-acknowledges-breach/

# data[].attributes.body
Jacob Hogg

# data[].attributes.attachment_link.readable_text
TechTarget defines a data breach as "an incident in which sensitive, protected, or confidential data has potentially been viewed, stolen, or used by an individual unauthorized to do so. Data breaches may involve payment card information (PCI), personal health information (PHI), personally identifiable information (PII), trade secrets, or intellectual property." But how long have data breaches been a concern for companies and consumers, and what kind of impact have data breaches had throughout history?

The Origin of Data Breaches

Data breaches have gained widespread attention as businesses of all sizes become increasingly reliant on digital data, cloud computing, and workforce mobility. With sensitive business data stored on local machines, on enterprise databases, and on cloud servers, breaching a company's data has become as simple - or as complex - as gaining access to restricted networks.

But data breaches didn't begin when companies began storing their protected data digitally. In fact, data breaches have existed for as long as individuals and companies have maintained records and stored private information. Before computing became commonplace, a data breach could be something as simple as viewing an individual's medical file without authorization or finding sensitive documents that weren't properly disposed of. Still, publicly-disclosed data breaches increased in frequency in the 1980s, and in the 1990s and early 2000s, public awareness of the potential for data breaches began to rise.

Laws and regulations such as HIPAA or the PCI Data Security Standard are created to provide guidelines for companies and organizations handling certain types of sensitive consumer information. These regulations provide a framework for the required safeguards, storage, and use practices for handling sensitive information. But these rules don't exist in all industries, nor do they definitively stop data breaches from occurring.

Most information on data breaches focuses on the time period from 2005 to today. This is largely due to the advancement of technology and proliferation of electronic data throughout the world, making data breaches a top concern for both enterprises and consumers. Today's data breaches can impact hundreds of thousands - often millions - of individual consumers, and even more individual records, all from a single attack on one company.

How Many Data Breaches Occur?

The Privacy Rights Clearinghouse, which reports on data breaches impacting consumers, maintains a chronology of data breaches and security breaches dating back to 2005. The data breaches reported by the Privacy Rights Clearinghouse include breaches in which the information compromised "includes data elements useful to identity thieves, such as Social Security numbers, account numbers, and driver's license numbers."

However, some breaches that do not compromise this type of sensitive information are also reported in order to provide a broad view of the variety and frequency of data breaches. Additionally, the data breaches reported here include only those reported in the United States, not incidents in other countries.

Most Historical Accounts Document Breaches from 2005 Onward

While data breaches were certainly occurring prior to 2005, most of the biggest data breaches recorded in history are reported in 2005 or beyond. This can be attributed to the fact that the world's volume of data has been growing exponentially year after year, giving cyber criminals a greater opportunity to expose massive volumes of data in a single breach.

Image via CSC.com.

Consider these projections from a 2012 report by CSC:

By 2020, over one-third of all data will live in or pass through the cloud.

In 2020, data production is estimated to be 44 times greater than it was in 2009; experts estimate a 4,300 percent increase in annual data generation by 2020.

While individuals are responsible for most data creation (70 percent), 80 percent of all data is stored by enterprises.

In 2005 alone, 136 data breaches were reported by the Privacy Rights Clearinghouse. More than 4,500 data breaches have been made public since 2005, with more than 816 million individual records breached. In actuality, this number is much higher, as the total number of records breached reported by the Privacy Rights Clearinghouse includes breach reports for which the number of records breached is unknown. Additionally, the Privacy Rights Clearinghouse is not a comprehensive compilation of all breach data, so the actual total records breached as a result of data breaches is likely substantially higher. For instance, the 2015 Verizon Data Breach Investigations Report covered over 2,100 data breaches in which more than 700 million records were exposed for the year 2014 alone.

Data Breaches Have Become Larger in Number and Impact

Several experts and other media outlets have attempted to name the largest data breaches in history. According to Statista, which reports on the number of data breaches and records exposed in the United States since 2005, the number of cyber attacks is on an upward trend. In 2005, for instance, 157 data breaches were reported in the U.S., with 66.9 million records exposed. In 2014, 783 data breaches were reported, with at least 85.61 million total records exposed, representing an increase of nearly 500 percent over 2005. And those are Statista's numbers, which are somewhat conservative when compared to the Verizon DBIR or other industry-standard data breach reports.

Image via Statista.com.

The trend is not consistently on an uphill slope, however. In 2009, for example, the number of total data breaches reported in the U.S. dropped to 498, from 656 in 2008. That said, the total number of individual records exposed increased sharply, from 35.7 million in 2008 to 222.5 million in 2009. These figures indicate that while fewer breaches occurred, the individual breaches were larger, resulting in a greater number of records exposed per breach.

There was also a decline in the number of data breaches reported between 2010 and 2011, with 662 data breaches reported in 2010, and 419 data breaches reported in 2011. Since 2011, however, the number of data breaches reported in the United States has been rising steadily:

447 data breaches reported in 2012

614 data breaches reported in 2013

783 data breaches reported in 2014

Forbes reports that over the past 10 years, there have been more than 300 data breaches resulting in the theft of 100,000 or more records. And that's just some of the data breaches that were publicly reported.

The Largest Data Breach in History

Interestingly, the largest data breach in history indirectly involved Experian, one of the three main credit reporting agencies. Experian acquired a company called Court Ventures, which gathers and aggregates information from public records, in March 2012. At the time of acquisition, Court Ventures had a contract with a company called U.S. Info Search, enabling customers of U.S. Info Search to access U.S. Info Search's data to find individuals' addresses to determine which court records to review.

Court Ventures sold information to a number of third parties, including a "Vietnamese fraudster service," which then provided its own customers with the opportunity to look up personal information of Americans, including financial information and Social Security numbers, which was then used for identity theft in many cases.

As Experian explains, "After Experian's acquisition of Court Ventures, the U.S. Secret Service notified us that Court Ventures had been and was continuing to resell data from a U.S. Info Search database to a third party, possibly engaged in illegal activity. The suspect in this case posed as a legitimate business owner and obtained access to U.S. Info Search data through Court Ventures prior to the time Experian acquired the company." Experian maintains that no Experian databases were breached; U.S. Info Search's databases were the source of the consumer information.

Some news sources cite 200 million records breached in this incident, which continued for more than 10 months after Experian acquired Court Ventures, although DataBreaches.net reports that 200 million is the figure representing the total number of records stored in the database that was breached. The actual number of records exposed, according to Experian, is unknown, but believed to be much lower.

Other Major Data Breaches

While the Experian/Court Ventures incident is often cited as the largest data breach in history, there are certainly many other data breaches that have gained widespread recognition as having substantial impact, or at minimum, threat of potential impact, on consumers.

In 2008 and 2009, Heartland Payment Systems suffered a data breach resulting in the compromise of 130 million records. A New Jersey-based payment processor, Heartland Payment Systems' data was breached through malware that was planted on Heartland's network, recording credit card data as it arrived from retailers, Tom's Guide reports. This data, obtained through Heartland's payment processing services for more than 250,000 businesses, was then exposed to cybercriminals. This data breach is regarded as the largest credit card scam in history.

Slate.com visualizes the largest data breaches in history, with data since 2005, in an infographic that illustrates whether breaches were the result of hacks, accidental publication, inside jobs, lost or stolen computers, lost or stolen media, poor security, viruses, or unknown causes.

Image via Slate.com.

The majority of the largest breaches recorded result from hacking attacks, while one of the earliest reported data breaches, impacting AOL and compromising 92 million records in 2005, is reported as an inside job. Another AOL breach, in 2006, resulted from accidental publishing of sensitive data; this breach compromised 20 million records.

A data breach impacting the U.S. military is another notable exception to the rule, with 76 million records compromised in 2009 as the result of lost or stolen media. Other notable major data breaches not previously discussed include:

Among these major data breaches are a multitude of other breaches affecting companies of all sizes, with varying levels of impact. This data, particularly in light of the fact that most of these breaches are carried out by hackers, illustrates that data breaches are becoming more widespread - and having a much larger impact, compromising millions of records containing sensitive consumer, company, or user data.

With even the world's largest companies suffering massive data breaches impacting millions of consumers, modern enterprises require a comprehensive, full-circle approach to data protection and security. The reactive approaches of yesterday simply don't cut it in the modern threat landscape.

Data Breach Defense and Prevention Resources

With the ever-increasing number of data breaches and increased threats to security - enterprise, small business, and personal security alike - data breach defense and prevention has advanced accordingly, offering greater protections and a more proactive approach to security to ensure the safety of sensitive information. The following resources offer additional information on the advancement of data protection, as well as valuable tips for preventing data breaches.

Members of the U.S. House of Representatives House Energy and Commerce Committee have advanced a bill that addresses the increased threat of cyber crime to consumers. "The Data Security and Breach Notification Act is a bipartisan solution to address the growing problem of cyber crimes and protect vulnerable information from criminals. The legislation establishes a nationwide safety regime for data protection and breach notification."

Verizon's annual Data Breach Investigations Report has become a security industry favorite for its assessments of thousands of data breaches that were investigated by Verizon, the U.S. Secret Service, and several partnering security organizations. Every year the DBIR sets out to analyze major trends in data breaches, victims being targeted, attack patterns, and more.

DataLossDB is an open source, community-maintained research project that covers publicly-disclosed data breaches across the globe. The site provides details around data loss incidents as well as analysis of historical data breach trends.

IT Business Edge provides a slideshow illustrating 8 Ways to Prevent Data Breaches, including tips such as instituting end user security awareness, performing regular vulnerability assessments, and other helpful tactics.

Data Breach Today is a multi-media news resource and a robust source of information on the latest data breaches, their impact, and strategies for preventing your company from falling victim to cyber criminals.

Data Breach Watch is another resource reporting on discovered data breaches, news, and trends impacting both consumers and companies in every vertical.

The Global Privacy & Security Compliance Law Blog is an excellent resource for companies faced with stringent and ever-changing security regulations and compliance requirements.

The Hill takes a critical look at data breach prevention practices in light of the alarming statistics on the number of data breaches and their subsequent fallouts in 2014. As this article points out, the number of data breaches that involved 100 million customer records or more doubled in 2014. In fact, one billion data records were either lost or stolen in 2014, a 71 percent increase over 2013. "It's time that executives and information security professionals accept the fact that their companies will be breached and start thinking outside the box when it comes to data security. To be in denial of this truth is to not accept reality."

This article from The New York Times discusses strategies for minimizing the risk of a data breach in light of the major breaches impacting some of the world's largest companies in recent history. One suggestion, for instance, is minimizing or eliminating the unnecessary storage of data. "Companies also need to think carefully about what data they are collecting and storing. By keeping lots of sensitive information, they place themselves and their customers at considerable - and in some cases unnecessarily greater - risk than if they had deleted the data or never collected it. To take one startling example, security experts say there was absolutely no reason for Target to have stored the four-digit personal identification numbers, or PINs, of their customers' debit cards."

Tom's IT Pro reports on new tools and technologies for preventing data breaches following the 2014 SecureWorld Expo.

While no company wants to suffer a data breach, healthcare providers and their business associates stand to lose even more from a data breach, with penalties under HIPAA for inadequately protecting personal health information. CIO takes a look at the risks of a data breach in the healthcare industry, offering 12 tips to prevent a healthcare data breach.

According to this article from TechTarget, "Assumption of breach is the new norm." The article goes on to describe how this critical shift in thinking is being used to create more stringent, comprehensive data breach protection policies and protocols.

As many of these sources point out, 2014 was a record-breaking year for data breaches, renewing the focus on the need for better methods for both preventing and responding to the (inevitable) data breach. This 60-minute webinar training from Bank Info Security discusses " The Changing Landscape of Data Breaches & Consumer Protection in 2015." The full webinar will be available on-demand soon.

Experian, itself subjected to the perils of the aftermath of a data breach, has released its second annual Data Breach Industry Forecast for 2015. The report provides an overview of data breach trends and the outlook for 2015, and also emphasizes the need for companies to have a data breach response plan.

Holland & Knight takes a look at " How Recent Data Breaches are Changing the Face of Cybersecurity for the Private Sector."

We at Digital Guardian regularly cover the topic of data breaches and provide insights on both preventing and responding to a data breach. In this expert roundup, we ask 30 data security experts to share the most important next step you should take following a data breach. In another roundup, we asked 27 data security experts for their insights on the most cost-effective ways startups can protect themselves from data breaches. Be sure to follow our blog for updates on the latest data security information, research, and discussions, and visit our resources section for analyst reports, case studies, data sheets, and other resources on data breach prevention and data security.

As the wave of data breaches continues to roll on, we take a look back at some of the largest and most damaging data breaches on record. Read on for a historical walk through breaches over time as well as resources for preventing data breaches.

# data[].attributes.attachment_link.description
As the wave of data breaches continues to roll on, we take a look back at some of the largest and most damaging data breaches on record. Read on for a historical walk through breaches over time as well as resources for preventing data breaches.

# data[].attributes.body
Kim Hassan

# data[].attributes.attachment_link.provider_name
We Aren't Just Protecting You From Identity Theft. We Protect Who You Are.

# data[].attributes.attachment_link.readable_text
Posted on February 8, 2016 by Judy Leary in Data Breach & Technology, Personal

Though security breaches are more common within the healthcare and financial industries, a recent data breach at the University of Central Florida (UCF) shows that no one is safe from hackers. On February 4, 2016, UCF revealed the discovery of an intrusion into its personal computer network that compromised the personal information of current and former students, faculty, and staff. To date, it is believed that approximately 63,000 individuals have been affected.

In a letter announcing the breach, UCF President John C. Hitt said the incident was discovered in January and reported to law enforcement officials. The university began an internal investigation, seeking help from a national digital forensics firm. The investigation revealed that though some key information - like financial/credit card info, grades, and medical records - was not stolen, it looks like the criminals did gain access to Social Security numbers. Unfortunately, Social Security numbers are a hot commodity among identity thieves because with those numbers, they are able to easily gain access to a wealth of other personal information.

UCF said that two main groups of individuals were affected by this data breach. They are:

Group 1: Some current student-athletes, as well as some former student-athletes who last played for UCF in 2014-2015. Other individuals in this group include some student staff members that support UCF teams.

What was stolen? First and last names, Social Security numbers, student ID numbers, sport, whether they were walk-ons or recruited, and the number of credit hours taken or in-progress.

Group 2: Current and former university employees in a category known as Other Personal Services (OPS). Those not sure of their employment category are encouraged to check with their supervisor or HR representative.

What was stolen? First and last names, Social Security numbers, and UCF-issued Employee Identification Numbers.

UCF will be sending out letters the week of February 8, 2016 to those who may have been affected by the breach. They will be offering one year of free credit monitoring and identity protection services to those impacted and have set up a call center for anyone with questions. The call center's number is 877-752-5527 and it is open Monday-Friday from 9am until 9pm.

In an effort to prevent a breach like this from happening again, UCF said they are working to enhance user account and password security, as well as expanding campus-wide information security and training.

Image courtesy of Flickr user Breezy Baldwin.

# data[].attributes.attachment_link.description
Though security breaches are more common within the healthcare and financial industries, a recent data breach at the University of Central Florida (UCF) shows that no one is safe from hackers. On February 4, 2016, UCF revealed the discovery of an intrusion into its personal computer network that compromised the personal information of current and...

# data[].attributes.headline
What do hackers do with Corporate Security Breaches 

# data[].attributes.subject
What do hackers do with Corporate Security Breaches 

# data[].attributes.attachment_link.readable_text
Corporate security breaches seem to make news headlines almost daily. Companies like Target, Sally Beauty, eBay, and more have recently been the victims of large-scale security breaches that resulted in millions of customers' personally identifiable information being stolen. That information is usually credit card information-data which is easily and immediately profitable-but can also include names, addresses, emails, Social Security numbers, and more.

In the case of this month's PF Chang's security breach in which millions of credit card numbers were stolen, the company's corporate headquarters wasn't even aware of the hacking event until it was brought to their attention that the credit card numbers were now for sale on a website that specializes in this kind of crime. A site that authorities believe may be based out of Russia is selling entire batches of card numbers to eager thieves, and one of the unifying factors in all of the cards is that they were used in a PF Chang's restaurant location between March and May of this year.

Before you go check out the site to see if your card is listed...don't. First of all, you won't see any credit card information without signing up as one of their underhanded customers and paying for card information. But even going to the site could open you up to malware that infects your computer and retrieves even more of your data.

But what do hackers actually do with the information they steal? They sell it to their own customers. Their customers pay that website for information such as your credit card number, then turn around and use your card number for either online purchases or by attaching your data to the magnetic stripe on the back of a blank card. They can even sell these replicas of your credit card and turn a quick profit.

This is yet another case of corporate theft in which millions of victims did nothing wrong but were still subjected to potential identity theft and financial fraud. Short of never using a credit card or debit card, there isn't a lot that consumers can do to prevent this kind of breach. However, it is certainly an example of the kinds of diligence that consumers must practice in order to protect themselves as much as possible.

First is to always read your credit card statements carefully, looking for any unauthorized charges or suspicious activity. You can also sign up for alerts from your credit card company, which will send you an email or text message any time a charge is made without your card being present. Also, choosing to do business with credit card companies who have a proven track record of watching their customers' accounts for this kind of problem is a good idea.

This kind of awareness can help minimize the damage from a security breach and give you all of the necessary paperwork to file a police report and clear this up with your credit card company. Remember to take all news of a breach seriously, and treat even the hint that your information was compromised as a serious issue.

If you found this information helpful, you may want to consider taking part in the Identity Theft Resource Center's Anyone3 fundraising campaign. For more information or to donate please visit http://www.idtheftcenter.org/anyone-3.

# data[].attributes.attachment_link.title
What Do Hackers Do with Corporate Security Breaches? | Data Breaches | Articles | ID Theft Blog

# data[].attributes.attachment_link.description
Corporate security breaches seem to make news headlines almost daily. Companies like Target, Sally Beauty, eBay, and more have recently been the victims of large-scale security breaches that resulted in millions of customers' personally identifiable information being stolen. That information is usually credit card information-data which is easily and immediately profitable-but can also include names, addresses, emails, Social Security numbers, and more.

# data[].attributes.body
Jayde Orenzuk

# data[].attributes.attachment_link.readable_text
The Verizon RISK Team - which publishes the popular Data Breach Investigations Report (DBIR) and performs cyber investigations for hundreds of commercial enterprises and government agencies across the globe - just released its 2017 Data Breach Digest.

Yahoo suffered the biggest known hack of user data ever, with more than 1 billion user accounts exposed.

Talk about polar opposites. And to think, Verizon Communications, Inc. will be acquiring Yahoo, Inc.'s core business for nearly $4.5 billion. The price tag is roughly $350 million less than what Verizon - the market leading U.S. wireless carrier - originally offered.

The cost per breach - as Verizon's RISK group calls it when determining the fallout in connection with a hack - on the Verizon and Yahoo! deal is staggering. $350 million is just for starters.

A story in Marketing Week this past summer reported that YouGov's BrandIndex - which measures corporate reputations - gave Yahoo a score of less than 4, compared with Google's score of 36.

Yahoo already has a shrunken reputation as an old school internet company trying to go new school with its Flickr, Tumblr, and other digital properties. The value of its business is tied to how many people are tuning their PCs, laptops, tablets, and smartphones into Yahoo channels.

Google's Gmail is used by more than 1 billion people and poses a major threat to Yahoo's user base. Switching from Yahoo Mail to Gmail is easy, and offers users more data security and peace of mind - with comparable services for photo sharing and other social activities. A mass defection of its email users would be a huge and costly blow to Yahoo.

Brian Krebs, author of the immensely popular blog Krebs on Security, a top source for deep-dive investigations into the latest hacks and breaches launched against corporations and governments, has been urging his friends and family to migrate off Yahoo mail for years. His blog states that Yahoo appeared to fall far behind its peers in blocking spam and other email-based attacks. A recent CSO story reports that Google's state-of-the-art email classifier detects abusive messages with 99.9 percent accuracy.

The big picture for Verizon - which originally offered nearly $5 billion to buy Yahoo - is taking over a massive (and hopefully loyal) user base. The more eyeballs for Verizon, the more advertising dollars for them.

An interesting twist on the deal - and one that Verizon corporate may not be thinking through - is how its own RISK Team may further devalue the Yahoo brand. The cybersecurity industry is sure to press for a DBIR assessment on the total cost-per-breach in connection with the Yahoo hacks.

Reputational harm due to a major data breach can be devastating. Target's reputation took a post-hack beating in 2013... and to this day the company remains inextricably linked to the list of biggest hack victims ever. Target, Sony, OPM, Yahoo, etc. - not the kind of list that any company wants to be on.

When the deal closes, will Verizon's RISK Team provide a report on the total damage costs involved with the Yahoo hacks? Is it possible that the total cost per breach would add another zero to the end of that $350 million? And what if they fail to provide a report? That could damage the RISK Team's brand.

In 2016, Verizon's RISK team investigated more than 500 cybersecurity incidents in more than 40 countries. The Verizon Enterprise Security group has been securing enterprise-level networks and infrastructure for decades. They provide professional services, network and gateway security, security monitoring and operations, incident response, and other security services. That's a big business in of itself - and one with lots of headroom for growth if Verizon corporate is serious about cybersecurity, a market that is projected to be worth $1 trillion over the next five years.

Security is at the core of Verizon's business - which includes network security around its customers wireless data. The trustworthiness of the Verizon brand is central to its market value.

Cybersecurity Ventures conducted a Twitter poll - asking is the Yahoo acquisition good or bad for Verizon's security business. Seventy-seven percent of respondents voted bad, and 23 percent voted good. (Disclaimer: Steve Morgan is founder and Editor-In-Chief at Cybersecurity Ventures, and he votes Good - more on that in a future story.)

One respondent, Thomas Doty, Esq., wrote "Bad. If the major oversight exhibited in the security and technical due diligence portion of this M&A action is any indication of Verizon's security IAM, then it indicates no benefit from that side of either organization. The breach liability tail surrounding this acquisition should have killed the deal, and may highlight that Verizon DBIR really is not reputable when it comes to actual security advice at a board level." Doty describes himself as a cyber evangelist with over 30 years technology experience as startup adviser, legal strategist, entrepreneur, attorney and military veteran.

Most of the other respondents - which included corporate executives, CISOs, and IT security team members - chose to remain anonymous.

By any measure, the Yahoo deal is risky business for Verizon.

# data[].attributes.attachment_link.title
Verizon's risky business: Acquiring the world's biggest hack

# data[].attributes.attachment_link.description
The Verizon RISK Team - which publishes the popular Data Breach Investigations Report (DBIR) and performs cyber investigations for hundreds of commercial enterprises and government agencies across the globe - just released its 2017 Data Breach Digest. Yahoo suffered the biggest known hack of user data ever, with more than 1 billion user accounts exposed.

# data[].attributes.headline
Fast Food Chain Arby’s Acknowledges Breach

# data[].attributes.subject
Fast Food Chain Arby’s Acknowledges Breach

# data[].attributes.body
Kaitlin McMillan

# data[].attributes.attachment_link.readable_text
Sources at nearly a half-dozen banks and credit unions independently reached out over the past 48 hours to inquire if I'd heard anything about a data breach at Arby's fast-food restaurants. Asked about the rumors, Arby's told KrebsOnSecurity that it recently remediated a breach involving malicious software installed on payment card systems at hundreds of its restaurant locations nationwide.

A spokesperson for Atlanta, Ga.-based Arby's said the company was first notified by industry partners in mid-January about a breach at some stores, but that it had not gone public about the incident at the request of the FBI.

"Arby's Restaurant Group, Inc. (ARG) was recently provided with information that prompted it to launch an investigation of its payment card systems," the company said in a written statement provided to KrebsOnSecurity.

"Upon learning of the incident, ARG immediately notified law enforcement and enlisted the expertise of leading security experts, including Mandiant," their statement continued. "While the investigation is ongoing, ARG quickly took measures to contain this incident and eradicate the malware from systems at restaurants that were impacted."

Arby's said the breach involved malware placed on payment systems inside Arby's corporate stores, and that Arby's franchised restaurant locations were not impacted.

Arby's has more than 3,330 stores in the United States, and roughly one-third of those are corporate-owned. The remaining stores are franchises. However, this distinction is likely to be lost on Arby's customers until the company releases more information about individual restaurant locations affected by the breach.

"Although there are over 1,000 corporate Arby's restaurants, not all of the corporate restaurants were affected," said Christopher Fuller, Arby's senior vice president of communications. "But this is the most important point: That we have fully contained and eradicated the malware that was on our point-of-sale systems."

The first clues about a possible breach at the sandwich chain came in a non-public alert issued by PSCU, a service organization that serves more than 800 credit unions.

The alert sent to PSCU member banks advised that PSCU had just received very long lists of compromised card numbers from both Visa and MasterCard. The alerts stated that a breach at an unnamed retailer compromised more than 355,000 credit and debit cards issued by PCSU member banks.

"PSCU believes the alerts are associated with a large fast food restaurant chain, yet to be announced to the public," reads the alert, which was sent only to PSCU member banks.

Arby's declined to say how long the malware was thought to have stolen credit and debit card data from infected corporate payment systems. But the PSCU notice said the breach is estimated to have occurred between Oct. 25, 2016 and January 19, 2017.

Such a large alert from the card associations is generally a sign of a sizable nationwide breach, as this is likely just the first of many alerts Visa and MasterCard will send to card-issuing banks regarding accounts that were compromised in the intrusion. If history is any lesson, some financial institutions will respond by re-issuing thousands of customer cards, while other (likely larger) institutions will focus on managing fraud losses on the compromised cards.

The breach at Arby's comes as many credit unions and smaller banks are still feeling the financial pain from fraud related to a similar breach at the fast food chain Wendy's. KrebsOnSecurity broke the news of that breach in January 2016, but the company didn't announce it had fully removed the malware from its systems until May 2016. But two months after that the company was forced to admit that many Wendy's locations were still compromised.

B. Dan Berger, president and CEO of the National Association of Federal Credit Unions, said the number of cards that PSCU told member banks were likely exposed in this breach is roughly in line with the numbers released not long after news of the Wendy's breach broke.

"Hundreds of thousands of cards is a big number, and with the Wendy's breach, the alerts we were getting from Visa and MasterCard were in the six-digit ranges for sure," Berger said. "That's probably one of the biggest numbers I've heard."

Berger said the Wendy's breach was especially painful because the company was re-compromised after it scrubbed its payment systems of malicious software. Many banks and credit unions ended up re-issuing customer cards several times throughout last year after loyal Wendy's customers re-compromised their brand new cards again and again because they routinely ate at multiple Wendy's locations throughout the month.

"We had institutions that stopped approving debit and credit transactions through Wendy's when they were still dealing with that breach," Berger said. "Our member credit unions were eating the costs of fraud on compromised cards, and on top of that having to re-issue the same cards over and over."

Point-of-sale malware has driven most of the major retail industry credit card breaches over the past two years, including intrusions at Target and Home Depot, as well as breaches at a slew of point-of-sale vendors. The malware sometimes is installed via hacked remote administration tools like LogMeIn; in other cases the malware is relayed via "spear-phishing" attacks that target company employees. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.

Thieves can then sell that data to crooks who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to purchase high-priced electronics and gift cards from big-box stores like Target and Best Buy.

Readers should remember that they're not liable for fraudulent charges on their credit or debit cards, but they still have to report the unauthorized transactions. There is no substitute for keeping a close eye on your card statements. Also, consider using credit cards instead of debit cards; having your checking account emptied of cash while your bank sorts out the situation can be a hassle and lead to secondary problems (bounced checks, for instance).

Tags: Arby's breach, Arby's Restaurant Group breach, Christopher Fuller, Dan Berger, Mandiant, mastercard, National Association of Federal Credit Unions, PSCU, Visa

# data[].attributes.attachment_link.description
Sources at nearly a half-dozen banks and credit unions independently reached out over the past 48 hours to inquire if I'd heard anything about a data breach at Arby's fast-food restaurants. Asked about the rumors, Arby's told KrebsOnSecurity that it recently remediated a breach involving malicious software installed on payment card systems at hundreds of its restaurant locations nationwide.

# data[].attributes.headline
Cardinals Investigated For Hacking Into Astros' Database

# data[].attributes.subject
Cardinals Investigated For Hacking Into Astros' Database

# data[].attributes.body
Maicie Clinansmith

# data[].attributes.attachment_link.readable_text
WASHINGTON - Front-office personnel for the St. Louis Cardinals, one of the most successful teams in baseball over the past two decades, are under investigation by the F.B.I. and Justice Department prosecutors, accused of hacking into an internal network of the Houston Astros to steal closely guarded information about players.

Investigators have uncovered evidence that Cardinals employees broke into a network of the Astros that housed special databases the team had built, law enforcement officials said. Internal discussions about trades, proprietary statistics and scouting reports were compromised, said the officials, who were not authorized to discuss a continuing investigation.

The officials did not say which employees were the focus of the investigation or whether the team's highest-ranking officials were aware of the hacking or authorized it. The investigation is being led by the F.B.I.'s Houston field office and has progressed to the point that subpoenas have been served on the Cardinals and Major League Baseball for electronic correspondence.

Law enforcement officials believe the hacking was executed by vengeful front-office employees for the Cardinals hoping to wreak havoc on the work of Jeff Luhnow, the Astros' general manager, who had been a successful and polarizing executive with the Cardinals until 2011.

The attack would represent the first known case of corporate espionage in which a professional sports team hacked the network of another team. Illegal intrusions into companies' networks have become commonplace, but they are generally conducted by hackers operating in foreign countries, like Russia and China, who steal large amounts of data or trade secrets for military equipment and electronics.

Major League Baseball "has been aware of and has fully cooperated with the federal investigation into the illegal breach of the Astros' baseball operations database," a spokesman for Commissioner Rob Manfred said in a written statement.

The Cardinals personnel under investigation have not been put on leave, suspended or fired. The commissioner's office will probably wait until the conclusion of the government's investigation to determine whether to take disciplinary action against the employees or the team.

"The St. Louis Cardinals are aware of the investigation into the security breach of the Houston Astros' database," the team said in a statement. "The team has fully cooperated with the investigation and will continue to do so. Given that this is an ongoing federal investigation, it is not appropriate for us to comment further."

The case is a rare mark of ignominy for the Cardinals, one of the sport's most revered and popular organizations. The team has the best record in the majors this season (43-21), regularly commands outsize television ratings and has reached the National League Championship Series nine times since 2000. The Cardinals, who last won the World Series in 2011, have 11 titles over all, second only to the Yankees.

From 1994 to 2012, the Astros and the Cardinals were division rivals in the N.L. For a part of that time, Mr. Luhnow was a Cardinals executive, primarily handling scouting and player development. One of many innovative thinkers drawn to the sport by the statistics-based "Moneyball" phenomenon, he was credited with building baseball's best minor league system, and with drafting several players who would become linchpins of that 2011 Cardinals team.

The Astros hired Mr. Luhnow as general manager in December 2011, and he quickly began applying his unconventional approach to running a baseball team. In an exploration of the team's radical transformation, Bloomberg Business called it "a project unlike anything baseball has seen before."

Under Mr. Luhnow, the Astros have accomplished a striking turnaround; they are in first place in the American League West division. But in 2013, before their revival at the major league level, their internal deliberations about statistics and players were compromised, the law enforcement officials said.

Image

The Houston Astros hired Luhnow as general manager in December 2011. Before then he had been a successful and polarizing executive with the Cardinals. Credit David J. Phillip/Associated Press

The intrusion did not appear to be sophisticated, the law enforcement officials said. When Mr. Luhnow was with the Cardinals, the team built a computer network, called Redbird, to house all of its baseball operations information - including scouting reports and player information. After he left to join the Astros, and took some front-office personnel with him from the Cardinals, Houston created a similar program known as Ground Control.

It contained the Astros' "collective baseball knowledge," according to a Bloomberg Business article published last year. The program took a series of variables and weighted them "according to the values determined by the team's statisticians, physicist, doctors, scouts and coaches," the article said.

Investigators believe that Cardinals personnel, concerned that Mr. Luhnow had taken their idea and proprietary baseball information to the Astros, examined a master list of passwords used by Mr. Luhnow and the other officials when they worked for the Cardinals. The Cardinals employees are believed to have used those passwords to gain access to the Astros' network, law enforcement officials said.

That tactic is often used by cybercriminals, who sell passwords from one breach on the underground market, where others buy them and test them on other websites, including banking and brokerage services. The breach on the Astros would be one of the first known instances of a corporate competitor using the tactic against a rival. It is also, security experts say, just one more reason people are advised not to use the same passwords across different sites and services.

Last year, some of the information from the Astros' computers was posted anonymously online, according to an article on the website Deadspin. Among the details that were exposed were trade discussions that the Astros had with other teams. Mr. Luhnow was asked at the time whether the breach would affect how he dealt with other teams. "Today I used a pencil and paper in all my conversations," he said.

Believing that the Astros' network had been compromised by a rogue hacker, Major League Baseball notified the F.B.I., and the authorities in Houston opened an investigation. Agents soon found that the Astros' network had been entered from a computer at a home that some Cardinals employees had lived in. The agents then turned their attention to the team's front office.

"The F.B.I. aggressively investigates all potential threats to public- and private-sector systems," an F.B.I. spokeswoman said. "Once our investigations are complete, we pursue all appropriate avenues to hold accountable those who pose a threat in cyberspace."

Nicole Perlroth contributed reporting.

A version of this article appears in print on , on Page A1 of the New York edition with the headline: Baseball Team Is Said to Breach Rival's Database. Order Reprints | Today's Paper | Subscribe

# data[].attributes.attachment_link.title
Cardinals Investigated for Hacking Into Astros' Database

# data[].attributes.attachment_link.description
WASHINGTON - Front-office personnel for the St. Louis Cardinals, one of the most successful teams in baseball over the past two decades, are under investigation by the F.B.I. and Justice Department prosecutors, accused of hacking into an internal network of the Houston Astros to steal closely guarded information about players.

# data[].attributes.headline
5 Huge Cyber Security Breaches At Companies You Know  

# data[].attributes.subject
5 Huge Cyber Security Breaches At Companies You Know  

# data[].attributes.body
Daniel Kivell

# data[].attributes.attachment_link.readable_text
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese.

On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households. That included customer names, addresses, phone numbers and email contact information. In addition, the breach affected about seven million of J.P. Morgan's small businesses customers. Overall, it may have been the biggest cyber attack in corporate history.

Here's a look at some of the biggest breaches at some top companies.

Even Walmart, the top company in this year's Fortune 500 list, hasn't been immune to cybersecurity breaches. According to an investigation by Wired in 2009, hackers broke into the computer system used by the company's (wmt) development team to steal information from cash registers. That data then found its way onto a computer in Eastern Europe.

Unlike other more recent breaches, Wal-Mart was not required to discuss the breach publicly, according to Wired, because the company called it an "internal issue."

In 2009, Wal-Mart's Chief Privacy Officer said the company was doing its best to "segregate the data, to make separate networks" and to "encrypt it fully" to safeguard from future data hacks.

Photograph by Kevork Djansezian-Getty Images

Home Depot (hd) may be your first stop for home improvement needs. But earlier this year, it fell victim to cyberthieves who stole up to 60 million card numbers. The attacks went on for five months before they were discovered. In September, the company said that anyone who used a credit card to shop in the U.S. or Canada over a six month period earlier this year could have been a victim.

At the time, Home Depot CEO Frank Blake called security a "major issue" and tried to reassure customers by saying the retailer had bolstered its lines of defense.

ALBANY, CA - MAY 15: A shopping cart stands in the parking lot of a Target store May 15, 2006 in Albany, California. Target announced a 12 percent rise in profit in its quarterly earnings report, falling short of market expectations. Target stock closed at $50.02, down $2.19. (Photo by Justin Sullivan/Getty Images) Photograph by Justin Sullivan-Getty Images

During last year's holiday season, there was little to cheer about for Target (tgt) shoppers. That's because of a massive security breach in which hackers accessed personal information about as many as 110 million consumers. The aftershocks are still reverberating for Target nearly a year later. In August, Target said the costs associated with the hacking added up to $148 million.

Photo by Spencer Platt-Getty Images

In one of the tech industry's racier scandals of 2014, hackers broke into the iCloud accounts of a number of Hollywood celebrities and made off with nude photos. Celebrities targeted included Jennifer Lawrence of "Hunger Games" fame, model Kate Upton and actress Kirsten Dunst. At the time, Apple (aapl) released a statement saying the breach wasn't system-wide, but rather due to specifically targeting the celebrity accounts. "None of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud or Find my iPhone," according to a statement. The timing, however, wasn't the best for the company, with its announcement of the new iPhone 6 phones slated for a few weeks later.

Photograph by Joe Raedle-Getty Images

Retailer Neiman Marcus suffered a cyber attack in February in which they culprits accessed the company's customer credit card records. In rifling through the database, the hackers set off 60,000 alerts that notified the retailer of questionable activity. But staff didn't pay much attention. For eight months, the hackers remained undetected and able to access information from cash registers, according to a Businessweek investigation. Originally, Neiman Marcus believed about 1.1 million customer cards were in danger. But the most recent estimate is 350,000, with about 9,000 cards used fraudulently, according to the company.

# data[].attributes.attachment_link.title
5 huge cybersecurity breaches at big companies

# data[].attributes.attachment_link.description
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese. On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households.

# data[].attributes.body
Anthony Wasyl

# data[].attributes.attachment_link.provider_name
We Aren't Just Protecting You From Identity Theft. We Protect Who You Are.

# data[].attributes.attachment_link.readable_text
Posted on December 16, 2016 by Judy Leary in Data Breach & Technology, Personal

2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

You may also be interested in:

FACC

January 25, 2016: FACC, an Austrian-based aerospace parts manufacturer (with clients like Airbus and Boeing), announced they fell victim to hackers in January 2016. The criminals, however, seemed to ignore the company's data and intellectual property, opting to instead steal approximately €50 million - which is equivalent to about $54.5 million U.S. dollars. FACC says that while they are investigating the extent of the damage and how it happened, their normal operations have not been affected.

University of Central Florida

February 8, 2016: At the beginning of February 2016, the University of Central Florida announced a data breach that affected approximately 63,000 current and former students, faculty, and staff. The breach was discovered in January, but before making the incident public, the university reported it to law enforcement and conducted an internal investigation. Unknown cyber criminals compromised the university's computer system and stole a variety of information including Social Security numbers, first and last names, and student/employee ID numbers.

U.S. Department of Justice

February 9, 2016: Hackers angry about U.S. relations with Israel tried to call attention to their cause in February 2016 by breaching the U.S. Department of Justice's database. CNN reported the hackers released data on 10,000 Department of Homeland Security employees one day, and then released data on 20,000 FBI employees the next day. Information stolen included names, titles, phone numbers, and e-mail addresses; the Department of Justice does not believe that any sensitive information, like Social Security numbers, was obtained. Tweeting from the account @DotGovs, the hackers said it took one week for the Department of Justice to realize that their systems had been compromised.

Internal Revenue Service

February 29, 2016: The Internal Revenue Service (IRS) announced that the data breach they uncovered in May 2015 was much larger than initially believed. In May, the IRS said over 100,000 American taxpayers had their personal information compromised when the agency's "Get Transcript" system was hacked. However, in February 2016, those numbers have been increased to over 700,000. The IRS thinks a sophisticated Russia-based criminal operation is responsible for the data breach and that identities were stolen to file fraudulent tax returns in the future.

UC Berkeley

February 29, 2016: The financial data of more than 80,000 University of California, Berkeley students, alumni, employees, and school officials was compromised around December 2015 and announced to the public in February 2016. The school says that although it was clear their system was hacked, it does not appear that any information was stolen. Those who may have been affected were notified and encouraged to keep an eye on their personal information.

Snapchat

March 3, 2016: 700 current and former Snapchat employees had their personal information stolen when hackers used a phishing scam to trick an employee into e-mailing them the private data. Posing as Snapchat chief executive Evan Spiegel, the attackers simply requested - and received - sensitive employee information including names, Social Security numbers, and wage/payroll data. It is presently unclear who is responsible for the attack or how they may use the information they stole.

21st Century Oncology

March 10, 2016: 21 st Century Oncology, a Fort Myers-based company offering cancer care services, revealed in a statement on their website that 2.2 million patients may have had personal information stolen when the company's system was breached in October 2015. The breach was discovered in November 2015, but the FBI discouraged the company from making a public announcement until March, as the investigation was ongoing. Though there is no evidence that the data has been used in any way, hackers did have access to patient names, Social Security numbers, doctor names, diagnosis and treatment information, and insurance information.

Premier Healthcare

March 10, 2016: A data breach was reported by Premier Healthcare, a multispecialty provider healthcare group, after a laptop computer was stolen from the billing department of their Bloomington, Indiana headquarters. The laptop was protected by a password, but it was not encrypted and contained sensitive data pertaining to more than 200,000 patients. Most victims affected had their names, dates of birth, and other basic information compromised, but Premier Healthcare says that 1,769 individuals may have had their Social Security numbers or financial information taken as well.

Verizon Enterprise Solutions

March 25, 2016: Verizon Enterprise Solutions, a division of Verizon known for providing IT services and data breach assistance to businesses and government agencies around the world, was hit by hackers who stole the information of about 1.5 million customers. The data was found for sale in an underground cybercrime forum by cybersecurity journalist Brian Krebs. Verizon acknowledged the breach, saying that they've found the security flaw, and are working to contact affected customers.

Systema Software

March 28, 2016: A data breach at California-based Systema Software was not the result of hackers, but an internal error during a system upgrade in which data storage was set up improperly and made publicly available on the Internet. Chris Vickery, a white-hat hacker, found the information online and reported it to the proper authorities - by that point, customer information had been exposed for 75 days. Affected customers include the Kansas State Self Insurance Fund, the CSAC Express Insurance Authority, American All-Risk Loss Administrators/Risico, Millers Mutual Group, Crosswalk Claims Management, and Salt Lake County. Currently, it is not believed that any of the personal information has been used illegally.

Tidewater Community College

March 28, 2016: Current and former employees of Tidewater Community College (TCC) in Norfolk, Virginia had their personal information stolen in a tax season phishing scam. An employee in the school's finance department received a request from a fake TCC e-mail address asking for all employee W-2 information. The individual, not realizing the e-mail was fake, responded with sensitive information including names, earnings, and Social Security numbers. TCC's spokesperson has said that at least 16 TCC employees have reported false tax returns filed under their Social Security numbers.

MedStar Health Inc.

March 30, 2016: The FBI is investigating a computer virus that paralyzed MedStar Health-operated hospitals in Maryland and Washington. Officials are trying to determine whether the virus was ransomware, which holds a company's systems "hostage" until a specific dollar amount is paid. It is not immediately clear whether any patient information was stolen, but with the popularity of medical identity theft among hackers, it is certainly possible that personal data was compromised.

Philippine Commission on Elections

April 11, 2016: A breach of the database for the Philippe Commission on Elections (COMELEC) prompted Infosecurity Magazine to say it "could rank as the worst government data breach anywhere." It is believed that the personal information of every single voter in the Philippines - approximately 55 million people - was compromised on March 27, 2016 by Anonymous; LulzSec Pilipinas published the database online a few days later and those private details are now available online for anyone to steal and engage in all different types of identity theft. Anonymous' actions were allegedly an effort to push COMELEC to turn on security features in the vote counting machines before the national elections on May 9.

Multiple Major E-mail Providers

May 5, 2016: Milwaukee-based Hold Security discovered more than 270 million e-mail usernames and passwords being given away for free in the Russian criminal underground. It is unknown how all of the accounts were stolen, but Hold counted about 57 million Mail.ru accounts, 40 million Yahoo accounts, 33 million Hotmail accounts, and 24 million Gmail addresses. There were also hundreds of thousands of German and Chinese email providers, along with username/password combinations that seem to belong to employees of major banking, manufacturing, and retail companies.

Wendy's

May 11, 2016: In January 2016, Wendy's began investigating a potential data breach after receiving reports of unusual activity involving payment cards at some of their restaurant locations. The details of that investigation became public in May, as the fast food chain revealed that less than 5 percent of its restaurants were affected. The company believes that malware infiltrated one particular point of sale system at fewer than 300 of approximately 5,500 franchised North America Wendy's restaurants, starting in the fall of 2015. Security expert Brian Krebs said many bank and credit unions "have been grumbling about the extent and duration of the breach" and that it seems some breached Wendy's locations were still leaking customer card data as late as the end of March 2016 into early April.

June 16, 2016 Update: In June 2016, Wendy's announced that their data breach was worse than they originally thought. The company did not provide much additional information - only that "additional malicious cyber activity has recently been discovered in some franchise-operated restaurants." They said that they disabled the newly discovered malware, but that "the number of franchise restaurants impacted by these cybersecurity attacks is now expected to be considerably higher than the 300 restaurants already implicated." Wendy's is continuing to work with security experts and federal law enforcement who are investigating the breach. Customers with questions can call 888-846-9467 or email PaymentCardUpdate@wendys.com

LinkedIn

May 17, 2016: A 2012 data breach came back to haunt LinkedIn when 117 million email and password combinations stolen by hackers four years ago popped up online. At the time the breach occurred, members who had been affected were told to reset their passwords. That information then became publicly available in May 2016. LinkedIn acted quickly to invalidate passwords of all LinkedIn accounts that were created prior to the 2012 breach and had not undergone a reset since the breach. It is not clear who stole the information or published it online, but LinkedIn is actively working with law enforcement officials.

Newkirk Products

August 12, 2016: In August 2016, Newkirk Products, a service provider that issues healthcare ID cards, announced a data breach that may have affected up to 3.3 million people. Unknown hackers were able to gain access to a server that contained sensitive member information, including names, mailing addresses, dates of birth, and details about health insurance plans. At this time, it does not appear that any of the stolen information has been used maliciously.

Oracle

August 12, 2016: The company that owns the MICROS point-of-sale system, used in more than 330,000 cash registers around the world, became the victim of a data breach, which was announced to the public in August of 2016. At the time the breach was uncovered by security expert Brian Krebs, it was unclear as to the size and scope; Krebs did say that a large Russian cybercrime group was likely to blame and that they had placed malware on company computers and on the MICROS customer support portal to steal usernames and passwords. Many experts also believe the hackers were probably able to plant malware in the MICROS point-of-sale systems and that they could be responsible for major data breaches at retailers around the country.

Dropbox

September 2, 2016: The popular file-hosting service was forced to confront a data breach from four years ago that affected more users than originally believed. In 2012, Dropbox helped a small amount of users secure their accounts after some usernames were stolen. At the end of August 2016, however, it was revealed that more than 68 million Dropbox users had their usernames and passwords compromised in that initial breach. It does not look like the accounts have been illegally accessed at this time, and all Dropbox users who have not reset their passwords since 2012 have been prompted by the company to do so.

Yahoo!

September 22, 2016: In what may be the most expansive data breach of all time, Yahoo announced that a hacker had stolen information from a minimum of 500 million accounts in late 2014. The thief, believed to be working on behalf of a foreign government, stole e-mail addresses, passwords, full user names, dates of birth, telephone numbers, and in some cases, security questions and answers. At the time of the breach announcement, Yahoo was still working with law enforcement and the FBI on an investigation.

Weebly

October 20, 2016: Over 43 million Weebly users were notified about a data breach that happened in February, but was just discovered in October. Stolen data included usernames, passwords, e-mail addresses, and IP information, but Weebly does not believe any type of financial information was stolen because it does not store full credit card numbers on its servers. Hackers were not able to log directly into customer websites because passwords were protected by bcrypt hashing.

National Payment Corporation of India

October 20, 2016: The National Payment Corporation of India (NPCI) was notified by international banks, primarily in the U.S. and China, that some of its customers' debit cards were being used illegally. Experts believe the breach began with a malware attack that originated at an ATM. The NPCI said that 32 lakh debit cards across 19 Indian banks were compromised, but customers were contacted to change the debit card PINs and customers they couldn't reach had their cards canceled and were issued new ones.

Cisco

November 3, 2016: An incorrect security setting on the mobile version of Cisco's "Professional Careers" website created a privacy hole that exposed the personal information of job-seekers. Discovered by an independent researcher, the security vulnerability made sensitive data available between August and September 2015, and again from July to August 2016. That data included names, addresses, e-mails, phone numbers, usernames, passwords, answers to security questions, resumes, cover letters, and voluntary information such as gender, race, veteran status, and disability.

At this time, there is no evidence that any other parties accessed the job-seekers' information, other than the independent researcher. Cisco did say, however, that "there was an instance of unexplained, anomalous connection to the server during that time, so we are taking precautionary steps." Those steps include alerting all Cisco job-seekers to the breach, requiring all users to reset their passwords, and offering to put 90-day fraud alerts on accounts for interested users.

AdultFriendFinder.com

November 13, 2016: AdultFriendFinder, an X-rated website, was targeted by hackers for the second time in two years. This time, though, the amount of accounts compromised was immense - approximately 412 million users had personal information stolen and published in online criminal marketplaces. The breached data included e-mail addresses, passwords, VIP member status, browser info, last IP address to log in, and purchases. LeakedSource is responsible for finding and reporting the breach to the public; AdultFriendFinder has only admitted to finding a vulnerability and has not confirmed the attack yet.

San Francisco Municipal Transportation Agency

November 25, 2016: San Francisco's public railway system, known as Muni, was infected with malware over the Thanksgiving weekend; this resulted in locked kiosks and computers and two days of free rides for passengers until the system went back online on Sunday, November 27. reached out to the hackers, who said the attack was not targeted - it was an automated attack, also known as a "spray and pray." In this type of attack, an automated system sends links to malware out to many prospective victims; an IT admin at the transportation agency allegedly clicked on the link and unknowingly downloaded the malware files.

The hackers claim to have 30GB of stolen data, which includes the personal information of employees and riders. They want the agency to fix its vulnerable systems and pay a ransom of 100 Bitcoins, or about $73,000 - if their demands aren't met, they say they will release all of the personal information. The agency's systems are back online, but as of now, it does not appear that they have paid the hackers.

Yahoo

December 14, 2016: Less than three months after announcing a 2014 data breach that affected 500 million users, Yahoo did it again - and even bigger than before. In December, the company discovered another breach from 2013 that may have compromised the personal information of one billion Yahoo accounts, making it the largest data breach in history. At the time of the breach announcement, Yahoo did not have much additional information to share with the public, as it was still unclear who was responsible, how they got into the system, and what they stole.

# data[].attributes.attachment_link.description
2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

# data[].attributes.headline
6 Biggest Business Security Risks and How You Can Fight Back

# data[].attributes.subject
6 Biggest Business Security Risks and How You Can Fight Back

# data[].attributes.body
Hanna Lehman

# data[].attributes.attachment_link.readable_text
Security breaches again made big news in 2014. Yet despite years of headline stories about security leaks and distributed denial-of-service (DDoS) attacks and repeated admonishments from security professionals that businesses (and individuals) needed to do a better job protecting sensitive data, many businesses are still unprepared or not properly protected from a variety of security threats.

Indeed, according to Trustwave's recent 2014 State of Risk Report, which surveyed 476 IT professionals about security weaknesses, a majority of businesses had no or only a partial system in place for controlling and tracking sensitive data.

So, what can companies do to better protect themselves and their customers', sensitive data from security threats? CIO.com queried dozens of security and IT experts to find out. Following are the six most likely sources, or causes, of security breaches and what businesses can, and should, do to protect against them.

Risk No. 1: Disgruntled Employees

"Internal attacks are one of the biggest threats facing your data and systems," states Cortney Thompson, CTO of Green House Data. "Rogue employees, especially members of the IT team with knowledge of and access to networks, data centers and admin accounts, can cause serious damage," he says. Indeed, "there [were] rumors that the Sony hack was not [carried out by] North Korea but [was actually] an inside job.
[ Related: Sony Hack Is a Corporate Cyberwar Game Changer[ Related: When Rogue IT Staffers Attack: 8 Organizations That Got Burned ] ]
Solution: "The first step in mitigating the risk of privileged account exploitation is to identify all privileged accounts and credentials [and] immediately terminate those that are no longer in use or are connected to employees that are no longer at the company," says Adam Bosnian, executive vice president, CyberArk.

"Next, closely monitor, control and manage privileged credentials to prevent exploitation. Finally, companies should implement necessary protocols and infrastructure to track, log and record privileged account activity [and create alerts, to] allow for a quick response to malicious activity and mitigate potential damage early in the attack cycle."

Risk No. 2: Careless or Uninformed Employees

"A careless worker who forgets [his] unlocked iPhone in a taxi is as dangerous as a disgruntled user who maliciously leaks information to a competitor," says Ray Potter, CEO, SafeLogic. Similarly, employees who are not trained in security best practices and have weak passwords, visit unauthorized websites and/or click on links in suspicious emails or open email attachments pose an enormous security threat to their employers' systems and data.

Solution: "Train employees on cyber security best practices and offer ongoing support," says Bill Carey, vice presdient of Marketing for RoboForm. "Some employees may not know how to protect themselves online, which can put your business data at risk," he explains. So it's essential to "hold training sessions to help employees learn how to manage passwords and avoid hacking through criminal activity like phishing and keylogger scams. Then provide ongoing support to make sure employees have the resources they need."

Also, "make sure employees use strong passwords on all devices," he adds. "Passwords are the first line of defense, so make sure employees use passwords that have upper and lowercase letters, numbers and symbols," Carey explains.

"It's also important to use a separate password for each registered site and to change it every 30 to 60 days," he continues. "A password management system can help by automating this process and eliminating the need for staff to remember multiple passwords."

Encryption is also essential.

"As long as you have deployed validated encryption as part of your security strategy, there is hope," says Potter. "Even if the employee hasn't taken personal precautions to lock their phone, your IT department can execute a selective wipe by revoking the decryption keys specifically used for the company data."

To be extra safe, "implement multifactor authentication such as One Time Password (OTP), RFID, smart card, fingerprint reader or retina scanning [to help ensure] that users are in fact who you believe they are," adds Rod Simmons, product group manager, BeyondTrust. "This helps mitigate the risk of a breach should a password be compromised."
[ Related: How to Create Seamless Mobile Security for Employees ]
Risk No. 3: Mobile Devices (BYOD)

"Data theft is at high vulnerability when employees are using mobile devices [particularly their own] to share data, access company information, or neglect to change mobile passwords," explains Jason Cook,CTO & vice president of Security, BT Americas. "According to a BT study, mobile security breaches have affected more than two-thirds (68 percent) of global organizations in the last 12 months."

Indeed, "as more enterprises embrace BYOD, they face risk exposure from those devices on the corporate network (behind the firewall, including via the VPN) in the event an app installs malware or other Trojan software that can access the device's network connection," says Ari Weil, vice president, Product Marketing, Yottaa.

Solution: Make sure you have a carefully spelled out BYOD policy. "With a BYOD policy in place, employees are better educated on device expectations and companies can better monitor email and documents that are being downloaded to company or employee-owned devices," says Piero DePaoli, senior director, Global Product Marketing, Symantec. "Monitoring effectively will provide companies with visibility into their mobile data loss risk, and will enable them to quickly pinpoint exposures if mobile devices are lost or stolen."

Similarly, companies should "implement mobile security solutions that protect both corporate data and access to corporate systems while also respecting user's privacy through containerization," advises Nicko van Someren, CTO, Good Technology. "By securely separating business applications and business data on users' devices, containerization ensures corporate content, credentials and configurations stay encrypted and under IT's control, adding a strong layer of defense to once vulnerable a points of entry."

You can also "mitigate BYOD risks with a hybrid cloud," adds Matthew Dornquast, CEO and cofounder, Code42. "As unsanctioned consumer apps and devices continue to creep into the workplace, IT should look to hybrid and private clouds for mitigating potential risks brought on by this workplace trend," he says. "Both options generally offer the capacity and elasticity of the public cloud to manage the plethora of devices and data, but with added security and privacy-such as the ability to keep encryption keys on-site no matter where the data is stored-for managing apps and devices across the enterprise."

# data[].attributes.attachment_link.title
6 biggest business security risks and how you can fight back

# data[].attributes.attachment_link.description
Security breaches again made big news in 2014. Yet despite years of headline stories about security leaks and distributed denial-of-service (DDoS) attacks and repeated admonishments from security professionals that businesses (and individuals) needed to do a better job protecting sensitive data, many businesses are still unprepared or not properly protected from a variety of security threats.

# data[].attributes.headline
The Biggest Data Breaches in 2016, So Far 

# data[].attributes.subject
The Biggest Data Breaches in 2016, So Far 

# data[].attributes.body
Adrian Leek

We all like to feel safe and enjoy conveniences in our daily living. But the scary truth is that there are people out there that are making a living by finding ways to steal our information any way that they can, and use it to take whatever they can.  This article, "The Biggest Data Breaches of 2016..." is an overview of some our most popular, everyday stops like Snapchat, Verizon, LinkedIn and even Wendys.  We certainly have to rethink how, why and when we share our information.  Convenience is valuable, but is it worth our peace of mind?

https://www.identityforce.com/blog/2016-data-breaches

# data[].attributes.headline
5 huge cybersecurity breaches at companies you know

# data[].attributes.subject
5 huge cybersecurity breaches at companies you know

# data[].attributes.body
Andrew Oswalt

# data[].attributes.attachment_link.readable_text
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese.

On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households. That included customer names, addresses, phone numbers and email contact information. In addition, the breach affected about seven million of J.P. Morgan's small businesses customers. Overall, it may have been the biggest cyber attack in corporate history.

Here's a look at some of the biggest breaches at some top companies.

Even Walmart, the top company in this year's Fortune 500 list, hasn't been immune to cybersecurity breaches. According to an investigation by Wired in 2009, hackers broke into the computer system used by the company's (wmt) development team to steal information from cash registers. That data then found its way onto a computer in Eastern Europe.

Unlike other more recent breaches, Wal-Mart was not required to discuss the breach publicly, according to Wired, because the company called it an "internal issue."

In 2009, Wal-Mart's Chief Privacy Officer said the company was doing its best to "segregate the data, to make separate networks" and to "encrypt it fully" to safeguard from future data hacks.

Photograph by Kevork Djansezian-Getty Images

Home Depot (hd) may be your first stop for home improvement needs. But earlier this year, it fell victim to cyberthieves who stole up to 60 million card numbers. The attacks went on for five months before they were discovered. In September, the company said that anyone who used a credit card to shop in the U.S. or Canada over a six month period earlier this year could have been a victim.

At the time, Home Depot CEO Frank Blake called security a "major issue" and tried to reassure customers by saying the retailer had bolstered its lines of defense.

ALBANY, CA - MAY 15: A shopping cart stands in the parking lot of a Target store May 15, 2006 in Albany, California. Target announced a 12 percent rise in profit in its quarterly earnings report, falling short of market expectations. Target stock closed at $50.02, down $2.19. (Photo by Justin Sullivan/Getty Images) Photograph by Justin Sullivan-Getty Images

During last year's holiday season, there was little to cheer about for Target (tgt) shoppers. That's because of a massive security breach in which hackers accessed personal information about as many as 110 million consumers. The aftershocks are still reverberating for Target nearly a year later. In August, Target said the costs associated with the hacking added up to $148 million.

Photo by Spencer Platt-Getty Images

In one of the tech industry's racier scandals of 2014, hackers broke into the iCloud accounts of a number of Hollywood celebrities and made off with nude photos. Celebrities targeted included Jennifer Lawrence of "Hunger Games" fame, model Kate Upton and actress Kirsten Dunst. At the time, Apple (aapl) released a statement saying the breach wasn't system-wide, but rather due to specifically targeting the celebrity accounts. "None of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud or Find my iPhone," according to a statement. The timing, however, wasn't the best for the company, with its announcement of the new iPhone 6 phones slated for a few weeks later.

Photograph by Joe Raedle-Getty Images

Retailer Neiman Marcus suffered a cyber attack in February in which they culprits accessed the company's customer credit card records. In rifling through the database, the hackers set off 60,000 alerts that notified the retailer of questionable activity. But staff didn't pay much attention. For eight months, the hackers remained undetected and able to access information from cash registers, according to a Businessweek investigation. Originally, Neiman Marcus believed about 1.1 million customer cards were in danger. But the most recent estimate is 350,000, with about 9,000 cards used fraudulently, according to the company.

# data[].attributes.attachment_link.title
5 huge cybersecurity breaches at big companies

# data[].attributes.attachment_link.description
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese. On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households.