# data[].attributes.body
True Stories

# data[].attributes.attachment_link.readable_text
Internet crime stories are dime a dozen but these examples will show you why online security is essential. From ethical hacking to blackmail and car hijacking, these true stories show how you must act now to secure your well-being in the digital landscape.

We carefully curated the best, most fascinating tech stories that cover the risks involved in any digital activity of device, so use the links below to navigate them.
The mom whose laptop was locked down by a ransomware attack
Tom was blackmailed because of his hacked Ashley Madison account
How ethical hackers took over her PC
They remote hacked his car
Ransomware deletes 2 years of academic papers
His WoW account got hacked. Twice
Your data has been breached
Catfish isn't dinner, it's lies, manipulation, and theft
Hillary Clinton's Aides Got Phished And Lost Her The Election
He fell prey to the same scam twice and lost $1,350
Who would want to be you? Some can even become You.
When your workplace, a gaming giant, gets hit
The casual, public Wi-Fi hack
Customer support falls prey to a social engineering hack
Hotel managers and clients had nightmares due to one lock hack posted

Cyber security incidents and getting hacked seem like distant, fascinating things where other people get hurt, but you stay safe. Truth is, getting hacked or scammed can happen to anyone and it might even have happened to you in the past.

The average number of devices used by you and most people have increased exponentially in the recent years. We're surrounded by IoT devices, wear smart bracelets, have friends who are betting their savings on cryptocurrency, and we sign up to dozens of social media platforms.

This means cyber attacks have a lot of ways to get to you - either by targeting you specifically or by simply compromising your info in large-scale attacks.

The best way to learn is through experience, so let's do just that.

Here are the real stories of people who got hacked and what they learned, plus some actionable tips to enhance your security.

1. The mom whose laptop was locked down by a ransomware attack

Two days before Thanksgiving, Alina's mother got hit by a ransomware attack.

5,726 files got locked by CryptoWall, an encryption malware so powerful it is almost impossible to recover the information.

Alina's mom contacted the attacker through the ransomware's communication feature. As all ransomware creators, he told her she can either pay to get her files back or lose them forever. Despite backing up her files 6 months ago, she decided that losing half a year's worth of photos, documents and other files was too much, and so decided to pay the ransom.

The price to unlock her files was 500$ in the first week and 1000$ in the second one, after which the files would be deleted. Payment was to be done in Bitcoin, a complicated process which she had to learn on the fly.

Because of a major snowstorm that closed down the banks, Alina's mom couldn't pay the ransom in the first week, and ended up having to plead with her attacker to not increase the price to 1,000$. Surprisingly, he accepted and gave her the key to unlock her files. However, no one should ever pay a ransom, the risks far outweigh the benefits.
The full story is here: How my mom got hacked & What I've learned after my mom got hacked (and her data held for ransom)
2. Tom was blackmailed because of his hacked Ashley Madison account

Sometimes it's not your fault. The websites you use get hacked and your information is exposed. Your instinct will be to say: "but I don't have anything to hide!"

Well, that's not exactly true, is it?

Tom started using Ashley Madison several years prior to it being hacked in 2015, as a way to cope with a strained marriage.

After the Ashley Madison hack, cyber criminals contacted him and demanded 500$ to remove his name from a publicly searchable registry. If not, they would also send an email to his family, informing them of Tom's affair.

Tom refused, believing that if he paid them, they would know that he had something to lose and could be blackmailed further. He was wise, but that didn't mean he didn't suffer.

In the end, Tom had to live knowing his affairs on AM could be exposed at any time by the hackers. Moreover, there were also people who took it up upon themselves to impart justice on people in circumstances they couldn't, or wouldn't, understand.

3. How ethical hackers took over her PC

Sophie is a technology reporter at the Daily Telegraph. As part of an assignment, she accepted to be part of an ethical hacking experiment.

Basically, a group of ethical hackers would try to compromise her system without her knowing how, when and where. Sophie only knew that it would happen at some point.

For a whole month, the hackers did an extensive research on Sophie, crawling through her Twitter and Facebook pages, Daily Telegraph articles and even found out her date of birth from a website on family trees.

Almost two months after the experiment began, the hackers launched their attack. They pretended to be whistleblowers in control of sensitive government information and sent her an email with some of the files attached.

The malware infection occurred the moment she opened the file, and the attackers got access to everything, including email address and web cam. And it wasn't even that difficult to do.

4. They remote hacked his car

Andy Greenberg, a senior writer at Wired, once took part in a groundbreaking experiment which tested how car hacking could be done. What did the experiment involve? His car would be remotely hacked while he was behind the wheel.
What's the first thing people do when they get hit by a malware attack?
As Andy drove on the highway, the hackers started to progressively take control of the car. First, they activated the air vents and windshield wipers. Next, the transmission was cut and finally, they remotely activated the breaks. And they did all of these things with Andy behind the wheel.

The experiment uncovered a massive flaw in Jeep's cars which was later fixed. Today, this is even easier to achieve, due to the rise of electric cars and the huge push towards autonomous vehicles like trucks, taxis and more.

5. Ransomware deletes 2 years of academic papers

They panic and ask for help in a dedicated forum: "My PC is infected. Please, can anyone help me? "

For this user however, it was too little, too late. For 2 years he worked on his academic papers, and then they got encrypted by ransomware. The timing was awful as well: it happened right before they were due. Antivirus didn't help and he had no backup.

We don't know what happened next, or if he paid the ransom to unlock his files. We hope he didn't pay.

What we do know is that ransomware attacks are much more frequent that you can imagine and they target individuals and businesses alike.

6. His WoW account got hacked. Twice

Gamers are favorite targets for cyber criminals, since they don't want to lose the time and money invested in a character and are willing to pay the ransom.

As a result of a potential phishing attempt, this guy had his WoW account hacked and all his progress lost. And it happened to him not once, but twice! To add insult to injury, the hacker created a new character named "Thanx" as a sign of appreciation for his "efforts" as a victim.

Fortunately for him, Blizzard customer service was responsive and recovered his account and all the progress it had on it.

The same type of attack happens in most popular online games. League of Legends phishing volumes are truly legendary, so we talked to their security team to find out how to avoid getting your account stolen.

7. Your data has been breached
Source
The Office of Personnel Management, OPM for short, can be considered the US Government's HR Department. Among other things, it keeps records of employee personal information, such as height, weight, hair and eye color.

In 2014, the OPM got hacked, and the information of 22 million government employees leaked, most likely in the hands of a foreign government.

Bad? Well, the 2017 Equifax saga was a nightmare of epic proportions.

143 million US consumers had their sensitive personal information exposed. That's 44% of the population and today we're still seeing reports of more Equifax leaks. Odds are, if you're a US citizen, your info is floating around on the dark web, at the mercy of cyber criminals.

What do you think the US government did to deal with the Equifax hack? After less than one month since the incident, the IRS awarded Equifax a contract for fraud detection.

Clearly, it's up to you and you alone to protect your identity.

8. Catfish isn't dinner, it's lies, manipulation and theft

Some people hack you not with malware or suspicious links, but by gaining your trust and love.

This journalist's mother started using the online dating site Match.com, and eventually formed a connection with a soldier on active duty in Afghanistan. After a while, the soldier asked for a 30,000$ loan to help him clear a sizeable inheritance of gold and jewelry from US customs.

By now, the journalist and her brother intervened, suspecting the soldier was catfishing their mother. In online slang, catfishing means pretending to be someone else in order to extract financial gains. Or it can be a twisted way to get attention and affection.

In the Match.com case, the victims confronted the man with their suspicions and other evidence they had accumulated over time. The supposed soldier revealed he was a man from Ghana trying to support his sisters, and scamming people online was the best way he knew how to do that.

9. Hillary Clinton's Aides Got Phished And Lost Her The Election

Unless you've been living under a rock, you definitely know why Hillary Clinton lost the US Election to Donald Trump. One of the biggest scandals of the decade was the Hillary Clinton leaked emails.

Do you know how that happened?

John Podesta was phished. Yes, the chairman of Hillary Clinton's campaign fell prey to a phishing attack. He received a suspicious mail and he wanted to flag it, but he made a typo. When forwarding the phishing email to a computer technician, he wrote "This is a legitimate email" instead of "illegitimate".

This gave hackers from Russia access to about 60,000 emails from Podesta's private Gmail account. They stole all that data, gave it to Wikileaks, and the rest is actual history.

"The FBI's laid-back approach meant that Russian hackers were able to roam inside the DNC's computer systems for almost seven months before Democratic officials finally realised the gravity of the attack and brought in external cybersecurity experts."

But it was too late, as the election results have shown.

10. He fell prey to the same scam twice and lost $1,350

In 2007, Justin was at a difficult point in his life. Unemployed, with a weak skill set and verging on alcoholism, Justin decided to turn his life around by moving to Italy.

Determined to find a cheap flight, Justin searched for sellers of frequent flyer miles. He found two sellers and talked to them over the phone. One of them even sent him a photo of his driver's license. In a twisted sequence of events, both of them scammed him for a total sum of 1350$.

Sounds unlikely? Think again.

Justin tried to find a cheap shortcut and get that 'too good to be true' deal and became blind to any potential scammers. Plus, the phone conversations and photos helped dispel any suspicions he might have.

This is how most scamming attempts succeed, by preying on people who give in to the fear of missing out.

11. Who would want to be you? Some can even become You.

One day, Laura received a call from her credit card company, saying someone else had tried to obtain a credit card using her name, address and social security number.

Before telling the police, Laura decided to assess the damage and look over her credit card reports.

The impersonator had gotten so deep into the system, she managed to override Laura's answers to the security questions. Eventually, she guessed the answers and saw the extent of the damage.
The story: 'Someone had taken over my life'
The impersonator had created more than 50 accounts in Laura's name, and got credit for utilities such as heat, cable, electricity and even a newspaper subscription. What's more, the companies went after Laura in order to get their money back.

After notifying the police and tracking down the impersonator, Laura got a court order and managed to fix a lot of the damage, but only after a lot of sweat and stress. While her case was a fortunate one, few people share her luck and this story should act as a reminder to always safeguard your personal information.

Another stolen identity case created a buzz on Reddit. This user had an argument with an old roommate, who then decided to take revenge. He created social media accounts using the victim's name, photoshopping the person with an ISIS flag and posting questionable content

12. When your workplace, a gaming giant, gets hit

In late 2014, one of the biggest and most expensive hacks ever recorded took place at Sony and one employee reveals the inside situation.

It took around a week for people who worked at Sony to get a grasp of the seriousness of the situation. Sony refused to inform them about the extent of the damage, so instead, they had to rely on news sources to get updated.

The next week after the attack, Sony employees found themselves thrown into the pre-PC age. Half of the companies 6800 computers and servers were rendered dead and had ALL of their information stolen and deleted.

As a result, employees had to rewrite every single deleted file by hand. Paper became the main form of communication, used in written memos and to-do-lists, even their salaries were paid using hand-written checks.

The damage didn't stop there. The hackers got a hold of employee personal information. The source of the article had to change all her credit card passwords, Facebook, Amazon and eBay accounts, almost 30 accounts in total.

13. The casual, public Wi-Fi hack

Maurits Martijn, a Dutch journalist at De Correspondent, entered a busy Amsterdam café with Wouter Slotboom, an ethical hacker.

Within a few minutes, Slotboom had set up his gear, consisting of a laptop and a small black device and connected to the coffeehouses Wi-Fi. Soon enough, his laptop started to display what other people in the café were doing on their devices: what games they were playing, what apps they had installed, Google searches, password and email accounts and more.

According to Slotboom, it wasn't even that difficult. All you needed was around $80-90 worth of software and equipment, an average intelligence and that was it, a few minutes was all it took to get a hold of a few dozen users personal information.

Slotboom's small, black device could fool a phone into connecting to his own Wi-Fi network, giving him control over the entire traffic coming and going from a device.

If Slotboom wanted to, he could wait until one user wrote in his email address and password and then take it over. With it, he could control most of the services registered on that email.

While you don't need to be paranoid every time you connect to a public Wi-Fi, it's best if you know the risks of doing so.

14. Customer support falls prey to a social engineering hack

What happens when customer support gives away your information? This Amazon user's tale is an insightful one.

An impersonator once found out some of Eric's fake information he used to register a website by looking into a public WHOIS registry for website owners.

The impersonator then used Eric's fake information in a conversation with an Amazon customer support representative and found out his real address and phone number. Using Eric's real information, the impersonator got in touch with various services and even managed to issue a new credit card in Eric's name.

Eric got wind of his impersonator's efforts by reading the customer support transcripts, and also found out his real purpose: to get the last 4 digits of his credit card.

Amazon didn't do anything to protect Eric's account, even though he repeatedly signaled the problem, so he finally decides to switch from Amazon to Google. As a parting note, he gets an email from Amazon implying they have provided the impersonator with the last 4 digits of his credit card.

This story about this guy's tumultuous experience with Amazon will make you think twice about storing confidential information in your online accounts. The fact that Amazon failed to protect his account and look into the matter shows how a lack of cyber security education can endanger users

15. Hotel managers and clients had nightmares due to one lock hack

In this Forbes story, reporters chronicles the chaos experienced by hotel managers and the panic felt by their customers after a burglar used online hacking tools to bypass the electronic locks on the doors.

"I had dreams about it for many nights. I'd wake up and think I saw someone standing there at my desk," says one of the victims of a burglary.

Simply put, the burglar watched a Black Hat Conference speaker demonstrating how to hack a certain type of electronic lock using only $50 worth of widely available tools. He then used that Onity-lock hack to do a series of break-ins.

How did this cautionary tale end? On a bittersweet note. The original burglar is serving a prison sentence, but the electronic locks in question can still be easily hacked.

A Wired reporter tried it himself, almost 6 years after the original Onity hack, and it still worked. He managed to break into a hotel room. His story is amazing and it follows the birth of the original hacking method, how the burglar got to it and what came out of the entire publicized event.

If you rely on electronic locks and other IoT devices to secure your belongings, this guide will be very useful: IOT SECURITY - All You Need To Know And Apply

Conclusion

These stories may help you realize that not protecting your information and relying on other Internet users to be nice and play fair is not a viable strategy.

Cyber criminals don't care about the consequences of their attacks. They only want to reach their purpose, and sometimes that purpose may have nothing to do with you. You could just be a collateral victim, but the aftermath would be all too real for you.

This story was originally published by Paul Cucu on November 3, 2016 and updated with recent cases on February 27, 2018 by Ana Dascalescu.

# data[].attributes.attachment_link.title
The 12+ Internet Crime Stories That Make Cybersecurity Measures Essential

# data[].attributes.attachment_link.description
You think you're safe online and have nothing to hide? Think again. These true stories are cyber security cases and social engineering methods that will make you reevaluate your online privacy, data safety and the consequences of getting hacked. Fascinating insights into hacking and cyber security.

# data[].attributes.headline
5 ways to protect yourself from Identity theft!

# data[].attributes.subject
5 ways to protect yourself from Identity theft!

# data[].attributes.body
1.Secure your phone
2. Shred your documents
3. Monitor your financial statements
4. Strengthen your passwords
5. Be smart about social media.

# data[].attributes.body
Hackers

# data[].attributes.attachment_link.provider_name
We Aren't Just Protecting You From Identity Theft. We Protect Who You Are.

# data[].attributes.attachment_link.readable_text
Posted on December 16, 2016 by Judy Leary in Data Breach & Technology, Personal

2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

You may also be interested in:

FACC

January 25, 2016: FACC, an Austrian-based aerospace parts manufacturer (with clients like Airbus and Boeing), announced they fell victim to hackers in January 2016. The criminals, however, seemed to ignore the company's data and intellectual property, opting to instead steal approximately €50 million - which is equivalent to about $54.5 million U.S. dollars. FACC says that while they are investigating the extent of the damage and how it happened, their normal operations have not been affected.

University of Central Florida

February 8, 2016: At the beginning of February 2016, the University of Central Florida announced a data breach that affected approximately 63,000 current and former students, faculty, and staff. The breach was discovered in January, but before making the incident public, the university reported it to law enforcement and conducted an internal investigation. Unknown cyber criminals compromised the university's computer system and stole a variety of information including Social Security numbers, first and last names, and student/employee ID numbers.

U.S. Department of Justice

February 9, 2016: Hackers angry about U.S. relations with Israel tried to call attention to their cause in February 2016 by breaching the U.S. Department of Justice's database. CNN reported the hackers released data on 10,000 Department of Homeland Security employees one day, and then released data on 20,000 FBI employees the next day. Information stolen included names, titles, phone numbers, and e-mail addresses; the Department of Justice does not believe that any sensitive information, like Social Security numbers, was obtained. Tweeting from the account @DotGovs, the hackers said it took one week for the Department of Justice to realize that their systems had been compromised.

Internal Revenue Service

February 29, 2016: The Internal Revenue Service (IRS) announced that the data breach they uncovered in May 2015 was much larger than initially believed. In May, the IRS said over 100,000 American taxpayers had their personal information compromised when the agency's "Get Transcript" system was hacked. However, in February 2016, those numbers have been increased to over 700,000. The IRS thinks a sophisticated Russia-based criminal operation is responsible for the data breach and that identities were stolen to file fraudulent tax returns in the future.

UC Berkeley

February 29, 2016: The financial data of more than 80,000 University of California, Berkeley students, alumni, employees, and school officials was compromised around December 2015 and announced to the public in February 2016. The school says that although it was clear their system was hacked, it does not appear that any information was stolen. Those who may have been affected were notified and encouraged to keep an eye on their personal information.

Snapchat

March 3, 2016: 700 current and former Snapchat employees had their personal information stolen when hackers used a phishing scam to trick an employee into e-mailing them the private data. Posing as Snapchat chief executive Evan Spiegel, the attackers simply requested - and received - sensitive employee information including names, Social Security numbers, and wage/payroll data. It is presently unclear who is responsible for the attack or how they may use the information they stole.

21st Century Oncology

March 10, 2016: 21 st Century Oncology, a Fort Myers-based company offering cancer care services, revealed in a statement on their website that 2.2 million patients may have had personal information stolen when the company's system was breached in October 2015. The breach was discovered in November 2015, but the FBI discouraged the company from making a public announcement until March, as the investigation was ongoing. Though there is no evidence that the data has been used in any way, hackers did have access to patient names, Social Security numbers, doctor names, diagnosis and treatment information, and insurance information.

Premier Healthcare

March 10, 2016: A data breach was reported by Premier Healthcare, a multispecialty provider healthcare group, after a laptop computer was stolen from the billing department of their Bloomington, Indiana headquarters. The laptop was protected by a password, but it was not encrypted and contained sensitive data pertaining to more than 200,000 patients. Most victims affected had their names, dates of birth, and other basic information compromised, but Premier Healthcare says that 1,769 individuals may have had their Social Security numbers or financial information taken as well.

Verizon Enterprise Solutions

March 25, 2016: Verizon Enterprise Solutions, a division of Verizon known for providing IT services and data breach assistance to businesses and government agencies around the world, was hit by hackers who stole the information of about 1.5 million customers. The data was found for sale in an underground cybercrime forum by cybersecurity journalist Brian Krebs. Verizon acknowledged the breach, saying that they've found the security flaw, and are working to contact affected customers.

Systema Software

March 28, 2016: A data breach at California-based Systema Software was not the result of hackers, but an internal error during a system upgrade in which data storage was set up improperly and made publicly available on the Internet. Chris Vickery, a white-hat hacker, found the information online and reported it to the proper authorities - by that point, customer information had been exposed for 75 days. Affected customers include the Kansas State Self Insurance Fund, the CSAC Express Insurance Authority, American All-Risk Loss Administrators/Risico, Millers Mutual Group, Crosswalk Claims Management, and Salt Lake County. Currently, it is not believed that any of the personal information has been used illegally.

Tidewater Community College

March 28, 2016: Current and former employees of Tidewater Community College (TCC) in Norfolk, Virginia had their personal information stolen in a tax season phishing scam. An employee in the school's finance department received a request from a fake TCC e-mail address asking for all employee W-2 information. The individual, not realizing the e-mail was fake, responded with sensitive information including names, earnings, and Social Security numbers. TCC's spokesperson has said that at least 16 TCC employees have reported false tax returns filed under their Social Security numbers.

MedStar Health Inc.

March 30, 2016: The FBI is investigating a computer virus that paralyzed MedStar Health-operated hospitals in Maryland and Washington. Officials are trying to determine whether the virus was ransomware, which holds a company's systems "hostage" until a specific dollar amount is paid. It is not immediately clear whether any patient information was stolen, but with the popularity of medical identity theft among hackers, it is certainly possible that personal data was compromised.

Philippine Commission on Elections

April 11, 2016: A breach of the database for the Philippe Commission on Elections (COMELEC) prompted Infosecurity Magazine to say it "could rank as the worst government data breach anywhere." It is believed that the personal information of every single voter in the Philippines - approximately 55 million people - was compromised on March 27, 2016 by Anonymous; LulzSec Pilipinas published the database online a few days later and those private details are now available online for anyone to steal and engage in all different types of identity theft. Anonymous' actions were allegedly an effort to push COMELEC to turn on security features in the vote counting machines before the national elections on May 9.

Multiple Major E-mail Providers

May 5, 2016: Milwaukee-based Hold Security discovered more than 270 million e-mail usernames and passwords being given away for free in the Russian criminal underground. It is unknown how all of the accounts were stolen, but Hold counted about 57 million Mail.ru accounts, 40 million Yahoo accounts, 33 million Hotmail accounts, and 24 million Gmail addresses. There were also hundreds of thousands of German and Chinese email providers, along with username/password combinations that seem to belong to employees of major banking, manufacturing, and retail companies.

Wendy's

May 11, 2016: In January 2016, Wendy's began investigating a potential data breach after receiving reports of unusual activity involving payment cards at some of their restaurant locations. The details of that investigation became public in May, as the fast food chain revealed that less than 5 percent of its restaurants were affected. The company believes that malware infiltrated one particular point of sale system at fewer than 300 of approximately 5,500 franchised North America Wendy's restaurants, starting in the fall of 2015. Security expert Brian Krebs said many bank and credit unions "have been grumbling about the extent and duration of the breach" and that it seems some breached Wendy's locations were still leaking customer card data as late as the end of March 2016 into early April.

June 16, 2016 Update: In June 2016, Wendy's announced that their data breach was worse than they originally thought. The company did not provide much additional information - only that "additional malicious cyber activity has recently been discovered in some franchise-operated restaurants." They said that they disabled the newly discovered malware, but that "the number of franchise restaurants impacted by these cybersecurity attacks is now expected to be considerably higher than the 300 restaurants already implicated." Wendy's is continuing to work with security experts and federal law enforcement who are investigating the breach. Customers with questions can call 888-846-9467 or email PaymentCardUpdate@wendys.com

LinkedIn

May 17, 2016: A 2012 data breach came back to haunt LinkedIn when 117 million email and password combinations stolen by hackers four years ago popped up online. At the time the breach occurred, members who had been affected were told to reset their passwords. That information then became publicly available in May 2016. LinkedIn acted quickly to invalidate passwords of all LinkedIn accounts that were created prior to the 2012 breach and had not undergone a reset since the breach. It is not clear who stole the information or published it online, but LinkedIn is actively working with law enforcement officials.

Newkirk Products

August 12, 2016: In August 2016, Newkirk Products, a service provider that issues healthcare ID cards, announced a data breach that may have affected up to 3.3 million people. Unknown hackers were able to gain access to a server that contained sensitive member information, including names, mailing addresses, dates of birth, and details about health insurance plans. At this time, it does not appear that any of the stolen information has been used maliciously.

Oracle

August 12, 2016: The company that owns the MICROS point-of-sale system, used in more than 330,000 cash registers around the world, became the victim of a data breach, which was announced to the public in August of 2016. At the time the breach was uncovered by security expert Brian Krebs, it was unclear as to the size and scope; Krebs did say that a large Russian cybercrime group was likely to blame and that they had placed malware on company computers and on the MICROS customer support portal to steal usernames and passwords. Many experts also believe the hackers were probably able to plant malware in the MICROS point-of-sale systems and that they could be responsible for major data breaches at retailers around the country.

Dropbox

September 2, 2016: The popular file-hosting service was forced to confront a data breach from four years ago that affected more users than originally believed. In 2012, Dropbox helped a small amount of users secure their accounts after some usernames were stolen. At the end of August 2016, however, it was revealed that more than 68 million Dropbox users had their usernames and passwords compromised in that initial breach. It does not look like the accounts have been illegally accessed at this time, and all Dropbox users who have not reset their passwords since 2012 have been prompted by the company to do so.

Yahoo!

September 22, 2016: In what may be the most expansive data breach of all time, Yahoo announced that a hacker had stolen information from a minimum of 500 million accounts in late 2014. The thief, believed to be working on behalf of a foreign government, stole e-mail addresses, passwords, full user names, dates of birth, telephone numbers, and in some cases, security questions and answers. At the time of the breach announcement, Yahoo was still working with law enforcement and the FBI on an investigation.

Weebly

October 20, 2016: Over 43 million Weebly users were notified about a data breach that happened in February, but was just discovered in October. Stolen data included usernames, passwords, e-mail addresses, and IP information, but Weebly does not believe any type of financial information was stolen because it does not store full credit card numbers on its servers. Hackers were not able to log directly into customer websites because passwords were protected by bcrypt hashing.

National Payment Corporation of India

October 20, 2016: The National Payment Corporation of India (NPCI) was notified by international banks, primarily in the U.S. and China, that some of its customers' debit cards were being used illegally. Experts believe the breach began with a malware attack that originated at an ATM. The NPCI said that 32 lakh debit cards across 19 Indian banks were compromised, but customers were contacted to change the debit card PINs and customers they couldn't reach had their cards canceled and were issued new ones.

Cisco

November 3, 2016: An incorrect security setting on the mobile version of Cisco's "Professional Careers" website created a privacy hole that exposed the personal information of job-seekers. Discovered by an independent researcher, the security vulnerability made sensitive data available between August and September 2015, and again from July to August 2016. That data included names, addresses, e-mails, phone numbers, usernames, passwords, answers to security questions, resumes, cover letters, and voluntary information such as gender, race, veteran status, and disability.

At this time, there is no evidence that any other parties accessed the job-seekers' information, other than the independent researcher. Cisco did say, however, that "there was an instance of unexplained, anomalous connection to the server during that time, so we are taking precautionary steps." Those steps include alerting all Cisco job-seekers to the breach, requiring all users to reset their passwords, and offering to put 90-day fraud alerts on accounts for interested users.

AdultFriendFinder.com

November 13, 2016: AdultFriendFinder, an X-rated website, was targeted by hackers for the second time in two years. This time, though, the amount of accounts compromised was immense - approximately 412 million users had personal information stolen and published in online criminal marketplaces. The breached data included e-mail addresses, passwords, VIP member status, browser info, last IP address to log in, and purchases. LeakedSource is responsible for finding and reporting the breach to the public; AdultFriendFinder has only admitted to finding a vulnerability and has not confirmed the attack yet.

San Francisco Municipal Transportation Agency

November 25, 2016: San Francisco's public railway system, known as Muni, was infected with malware over the Thanksgiving weekend; this resulted in locked kiosks and computers and two days of free rides for passengers until the system went back online on Sunday, November 27. reached out to the hackers, who said the attack was not targeted - it was an automated attack, also known as a "spray and pray." In this type of attack, an automated system sends links to malware out to many prospective victims; an IT admin at the transportation agency allegedly clicked on the link and unknowingly downloaded the malware files.

The hackers claim to have 30GB of stolen data, which includes the personal information of employees and riders. They want the agency to fix its vulnerable systems and pay a ransom of 100 Bitcoins, or about $73,000 - if their demands aren't met, they say they will release all of the personal information. The agency's systems are back online, but as of now, it does not appear that they have paid the hackers.

Yahoo

December 14, 2016: Less than three months after announcing a 2014 data breach that affected 500 million users, Yahoo did it again - and even bigger than before. In December, the company discovered another breach from 2013 that may have compromised the personal information of one billion Yahoo accounts, making it the largest data breach in history. At the time of the breach announcement, Yahoo did not have much additional information to share with the public, as it was still unclear who was responsible, how they got into the system, and what they stole.

# data[].attributes.attachment_link.description
2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

# data[].attributes.body
Hackers

# data[].attributes.attachment_link.provider_name
We Aren't Just Protecting You From Identity Theft. We Protect Who You Are.

# data[].attributes.attachment_link.readable_text
Posted on December 16, 2016 by Judy Leary in Data Breach & Technology, Personal

2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

You may also be interested in:

FACC

January 25, 2016: FACC, an Austrian-based aerospace parts manufacturer (with clients like Airbus and Boeing), announced they fell victim to hackers in January 2016. The criminals, however, seemed to ignore the company's data and intellectual property, opting to instead steal approximately €50 million - which is equivalent to about $54.5 million U.S. dollars. FACC says that while they are investigating the extent of the damage and how it happened, their normal operations have not been affected.

University of Central Florida

February 8, 2016: At the beginning of February 2016, the University of Central Florida announced a data breach that affected approximately 63,000 current and former students, faculty, and staff. The breach was discovered in January, but before making the incident public, the university reported it to law enforcement and conducted an internal investigation. Unknown cyber criminals compromised the university's computer system and stole a variety of information including Social Security numbers, first and last names, and student/employee ID numbers.

U.S. Department of Justice

February 9, 2016: Hackers angry about U.S. relations with Israel tried to call attention to their cause in February 2016 by breaching the U.S. Department of Justice's database. CNN reported the hackers released data on 10,000 Department of Homeland Security employees one day, and then released data on 20,000 FBI employees the next day. Information stolen included names, titles, phone numbers, and e-mail addresses; the Department of Justice does not believe that any sensitive information, like Social Security numbers, was obtained. Tweeting from the account @DotGovs, the hackers said it took one week for the Department of Justice to realize that their systems had been compromised.

Internal Revenue Service

February 29, 2016: The Internal Revenue Service (IRS) announced that the data breach they uncovered in May 2015 was much larger than initially believed. In May, the IRS said over 100,000 American taxpayers had their personal information compromised when the agency's "Get Transcript" system was hacked. However, in February 2016, those numbers have been increased to over 700,000. The IRS thinks a sophisticated Russia-based criminal operation is responsible for the data breach and that identities were stolen to file fraudulent tax returns in the future.

UC Berkeley

February 29, 2016: The financial data of more than 80,000 University of California, Berkeley students, alumni, employees, and school officials was compromised around December 2015 and announced to the public in February 2016. The school says that although it was clear their system was hacked, it does not appear that any information was stolen. Those who may have been affected were notified and encouraged to keep an eye on their personal information.

Snapchat

March 3, 2016: 700 current and former Snapchat employees had their personal information stolen when hackers used a phishing scam to trick an employee into e-mailing them the private data. Posing as Snapchat chief executive Evan Spiegel, the attackers simply requested - and received - sensitive employee information including names, Social Security numbers, and wage/payroll data. It is presently unclear who is responsible for the attack or how they may use the information they stole.

21st Century Oncology

March 10, 2016: 21 st Century Oncology, a Fort Myers-based company offering cancer care services, revealed in a statement on their website that 2.2 million patients may have had personal information stolen when the company's system was breached in October 2015. The breach was discovered in November 2015, but the FBI discouraged the company from making a public announcement until March, as the investigation was ongoing. Though there is no evidence that the data has been used in any way, hackers did have access to patient names, Social Security numbers, doctor names, diagnosis and treatment information, and insurance information.

Premier Healthcare

March 10, 2016: A data breach was reported by Premier Healthcare, a multispecialty provider healthcare group, after a laptop computer was stolen from the billing department of their Bloomington, Indiana headquarters. The laptop was protected by a password, but it was not encrypted and contained sensitive data pertaining to more than 200,000 patients. Most victims affected had their names, dates of birth, and other basic information compromised, but Premier Healthcare says that 1,769 individuals may have had their Social Security numbers or financial information taken as well.

Verizon Enterprise Solutions

March 25, 2016: Verizon Enterprise Solutions, a division of Verizon known for providing IT services and data breach assistance to businesses and government agencies around the world, was hit by hackers who stole the information of about 1.5 million customers. The data was found for sale in an underground cybercrime forum by cybersecurity journalist Brian Krebs. Verizon acknowledged the breach, saying that they've found the security flaw, and are working to contact affected customers.

Systema Software

March 28, 2016: A data breach at California-based Systema Software was not the result of hackers, but an internal error during a system upgrade in which data storage was set up improperly and made publicly available on the Internet. Chris Vickery, a white-hat hacker, found the information online and reported it to the proper authorities - by that point, customer information had been exposed for 75 days. Affected customers include the Kansas State Self Insurance Fund, the CSAC Express Insurance Authority, American All-Risk Loss Administrators/Risico, Millers Mutual Group, Crosswalk Claims Management, and Salt Lake County. Currently, it is not believed that any of the personal information has been used illegally.

Tidewater Community College

March 28, 2016: Current and former employees of Tidewater Community College (TCC) in Norfolk, Virginia had their personal information stolen in a tax season phishing scam. An employee in the school's finance department received a request from a fake TCC e-mail address asking for all employee W-2 information. The individual, not realizing the e-mail was fake, responded with sensitive information including names, earnings, and Social Security numbers. TCC's spokesperson has said that at least 16 TCC employees have reported false tax returns filed under their Social Security numbers.

MedStar Health Inc.

March 30, 2016: The FBI is investigating a computer virus that paralyzed MedStar Health-operated hospitals in Maryland and Washington. Officials are trying to determine whether the virus was ransomware, which holds a company's systems "hostage" until a specific dollar amount is paid. It is not immediately clear whether any patient information was stolen, but with the popularity of medical identity theft among hackers, it is certainly possible that personal data was compromised.

Philippine Commission on Elections

April 11, 2016: A breach of the database for the Philippe Commission on Elections (COMELEC) prompted Infosecurity Magazine to say it "could rank as the worst government data breach anywhere." It is believed that the personal information of every single voter in the Philippines - approximately 55 million people - was compromised on March 27, 2016 by Anonymous; LulzSec Pilipinas published the database online a few days later and those private details are now available online for anyone to steal and engage in all different types of identity theft. Anonymous' actions were allegedly an effort to push COMELEC to turn on security features in the vote counting machines before the national elections on May 9.

Multiple Major E-mail Providers

May 5, 2016: Milwaukee-based Hold Security discovered more than 270 million e-mail usernames and passwords being given away for free in the Russian criminal underground. It is unknown how all of the accounts were stolen, but Hold counted about 57 million Mail.ru accounts, 40 million Yahoo accounts, 33 million Hotmail accounts, and 24 million Gmail addresses. There were also hundreds of thousands of German and Chinese email providers, along with username/password combinations that seem to belong to employees of major banking, manufacturing, and retail companies.

Wendy's

May 11, 2016: In January 2016, Wendy's began investigating a potential data breach after receiving reports of unusual activity involving payment cards at some of their restaurant locations. The details of that investigation became public in May, as the fast food chain revealed that less than 5 percent of its restaurants were affected. The company believes that malware infiltrated one particular point of sale system at fewer than 300 of approximately 5,500 franchised North America Wendy's restaurants, starting in the fall of 2015. Security expert Brian Krebs said many bank and credit unions "have been grumbling about the extent and duration of the breach" and that it seems some breached Wendy's locations were still leaking customer card data as late as the end of March 2016 into early April.

June 16, 2016 Update: In June 2016, Wendy's announced that their data breach was worse than they originally thought. The company did not provide much additional information - only that "additional malicious cyber activity has recently been discovered in some franchise-operated restaurants." They said that they disabled the newly discovered malware, but that "the number of franchise restaurants impacted by these cybersecurity attacks is now expected to be considerably higher than the 300 restaurants already implicated." Wendy's is continuing to work with security experts and federal law enforcement who are investigating the breach. Customers with questions can call 888-846-9467 or email PaymentCardUpdate@wendys.com

LinkedIn

May 17, 2016: A 2012 data breach came back to haunt LinkedIn when 117 million email and password combinations stolen by hackers four years ago popped up online. At the time the breach occurred, members who had been affected were told to reset their passwords. That information then became publicly available in May 2016. LinkedIn acted quickly to invalidate passwords of all LinkedIn accounts that were created prior to the 2012 breach and had not undergone a reset since the breach. It is not clear who stole the information or published it online, but LinkedIn is actively working with law enforcement officials.

Newkirk Products

August 12, 2016: In August 2016, Newkirk Products, a service provider that issues healthcare ID cards, announced a data breach that may have affected up to 3.3 million people. Unknown hackers were able to gain access to a server that contained sensitive member information, including names, mailing addresses, dates of birth, and details about health insurance plans. At this time, it does not appear that any of the stolen information has been used maliciously.

Oracle

August 12, 2016: The company that owns the MICROS point-of-sale system, used in more than 330,000 cash registers around the world, became the victim of a data breach, which was announced to the public in August of 2016. At the time the breach was uncovered by security expert Brian Krebs, it was unclear as to the size and scope; Krebs did say that a large Russian cybercrime group was likely to blame and that they had placed malware on company computers and on the MICROS customer support portal to steal usernames and passwords. Many experts also believe the hackers were probably able to plant malware in the MICROS point-of-sale systems and that they could be responsible for major data breaches at retailers around the country.

Dropbox

September 2, 2016: The popular file-hosting service was forced to confront a data breach from four years ago that affected more users than originally believed. In 2012, Dropbox helped a small amount of users secure their accounts after some usernames were stolen. At the end of August 2016, however, it was revealed that more than 68 million Dropbox users had their usernames and passwords compromised in that initial breach. It does not look like the accounts have been illegally accessed at this time, and all Dropbox users who have not reset their passwords since 2012 have been prompted by the company to do so.

Yahoo!

September 22, 2016: In what may be the most expansive data breach of all time, Yahoo announced that a hacker had stolen information from a minimum of 500 million accounts in late 2014. The thief, believed to be working on behalf of a foreign government, stole e-mail addresses, passwords, full user names, dates of birth, telephone numbers, and in some cases, security questions and answers. At the time of the breach announcement, Yahoo was still working with law enforcement and the FBI on an investigation.

Weebly

October 20, 2016: Over 43 million Weebly users were notified about a data breach that happened in February, but was just discovered in October. Stolen data included usernames, passwords, e-mail addresses, and IP information, but Weebly does not believe any type of financial information was stolen because it does not store full credit card numbers on its servers. Hackers were not able to log directly into customer websites because passwords were protected by bcrypt hashing.

National Payment Corporation of India

October 20, 2016: The National Payment Corporation of India (NPCI) was notified by international banks, primarily in the U.S. and China, that some of its customers' debit cards were being used illegally. Experts believe the breach began with a malware attack that originated at an ATM. The NPCI said that 32 lakh debit cards across 19 Indian banks were compromised, but customers were contacted to change the debit card PINs and customers they couldn't reach had their cards canceled and were issued new ones.

Cisco

November 3, 2016: An incorrect security setting on the mobile version of Cisco's "Professional Careers" website created a privacy hole that exposed the personal information of job-seekers. Discovered by an independent researcher, the security vulnerability made sensitive data available between August and September 2015, and again from July to August 2016. That data included names, addresses, e-mails, phone numbers, usernames, passwords, answers to security questions, resumes, cover letters, and voluntary information such as gender, race, veteran status, and disability.

At this time, there is no evidence that any other parties accessed the job-seekers' information, other than the independent researcher. Cisco did say, however, that "there was an instance of unexplained, anomalous connection to the server during that time, so we are taking precautionary steps." Those steps include alerting all Cisco job-seekers to the breach, requiring all users to reset their passwords, and offering to put 90-day fraud alerts on accounts for interested users.

AdultFriendFinder.com

November 13, 2016: AdultFriendFinder, an X-rated website, was targeted by hackers for the second time in two years. This time, though, the amount of accounts compromised was immense - approximately 412 million users had personal information stolen and published in online criminal marketplaces. The breached data included e-mail addresses, passwords, VIP member status, browser info, last IP address to log in, and purchases. LeakedSource is responsible for finding and reporting the breach to the public; AdultFriendFinder has only admitted to finding a vulnerability and has not confirmed the attack yet.

San Francisco Municipal Transportation Agency

November 25, 2016: San Francisco's public railway system, known as Muni, was infected with malware over the Thanksgiving weekend; this resulted in locked kiosks and computers and two days of free rides for passengers until the system went back online on Sunday, November 27. reached out to the hackers, who said the attack was not targeted - it was an automated attack, also known as a "spray and pray." In this type of attack, an automated system sends links to malware out to many prospective victims; an IT admin at the transportation agency allegedly clicked on the link and unknowingly downloaded the malware files.

The hackers claim to have 30GB of stolen data, which includes the personal information of employees and riders. They want the agency to fix its vulnerable systems and pay a ransom of 100 Bitcoins, or about $73,000 - if their demands aren't met, they say they will release all of the personal information. The agency's systems are back online, but as of now, it does not appear that they have paid the hackers.

Yahoo

December 14, 2016: Less than three months after announcing a 2014 data breach that affected 500 million users, Yahoo did it again - and even bigger than before. In December, the company discovered another breach from 2013 that may have compromised the personal information of one billion Yahoo accounts, making it the largest data breach in history. At the time of the breach announcement, Yahoo did not have much additional information to share with the public, as it was still unclear who was responsible, how they got into the system, and what they stole.

# data[].attributes.attachment_link.description
2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

# data[].attributes.body
Hackers

# data[].attributes.attachment_link.provider_name
We Aren't Just Protecting You From Identity Theft. We Protect Who You Are.

# data[].attributes.attachment_link.readable_text
Posted on December 16, 2016 by Judy Leary in Data Breach & Technology, Personal

2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

You may also be interested in:

FACC

January 25, 2016: FACC, an Austrian-based aerospace parts manufacturer (with clients like Airbus and Boeing), announced they fell victim to hackers in January 2016. The criminals, however, seemed to ignore the company's data and intellectual property, opting to instead steal approximately €50 million - which is equivalent to about $54.5 million U.S. dollars. FACC says that while they are investigating the extent of the damage and how it happened, their normal operations have not been affected.

University of Central Florida

February 8, 2016: At the beginning of February 2016, the University of Central Florida announced a data breach that affected approximately 63,000 current and former students, faculty, and staff. The breach was discovered in January, but before making the incident public, the university reported it to law enforcement and conducted an internal investigation. Unknown cyber criminals compromised the university's computer system and stole a variety of information including Social Security numbers, first and last names, and student/employee ID numbers.

U.S. Department of Justice

February 9, 2016: Hackers angry about U.S. relations with Israel tried to call attention to their cause in February 2016 by breaching the U.S. Department of Justice's database. CNN reported the hackers released data on 10,000 Department of Homeland Security employees one day, and then released data on 20,000 FBI employees the next day. Information stolen included names, titles, phone numbers, and e-mail addresses; the Department of Justice does not believe that any sensitive information, like Social Security numbers, was obtained. Tweeting from the account @DotGovs, the hackers said it took one week for the Department of Justice to realize that their systems had been compromised.

Internal Revenue Service

February 29, 2016: The Internal Revenue Service (IRS) announced that the data breach they uncovered in May 2015 was much larger than initially believed. In May, the IRS said over 100,000 American taxpayers had their personal information compromised when the agency's "Get Transcript" system was hacked. However, in February 2016, those numbers have been increased to over 700,000. The IRS thinks a sophisticated Russia-based criminal operation is responsible for the data breach and that identities were stolen to file fraudulent tax returns in the future.

UC Berkeley

February 29, 2016: The financial data of more than 80,000 University of California, Berkeley students, alumni, employees, and school officials was compromised around December 2015 and announced to the public in February 2016. The school says that although it was clear their system was hacked, it does not appear that any information was stolen. Those who may have been affected were notified and encouraged to keep an eye on their personal information.

Snapchat

March 3, 2016: 700 current and former Snapchat employees had their personal information stolen when hackers used a phishing scam to trick an employee into e-mailing them the private data. Posing as Snapchat chief executive Evan Spiegel, the attackers simply requested - and received - sensitive employee information including names, Social Security numbers, and wage/payroll data. It is presently unclear who is responsible for the attack or how they may use the information they stole.

21st Century Oncology

March 10, 2016: 21 st Century Oncology, a Fort Myers-based company offering cancer care services, revealed in a statement on their website that 2.2 million patients may have had personal information stolen when the company's system was breached in October 2015. The breach was discovered in November 2015, but the FBI discouraged the company from making a public announcement until March, as the investigation was ongoing. Though there is no evidence that the data has been used in any way, hackers did have access to patient names, Social Security numbers, doctor names, diagnosis and treatment information, and insurance information.

Premier Healthcare

March 10, 2016: A data breach was reported by Premier Healthcare, a multispecialty provider healthcare group, after a laptop computer was stolen from the billing department of their Bloomington, Indiana headquarters. The laptop was protected by a password, but it was not encrypted and contained sensitive data pertaining to more than 200,000 patients. Most victims affected had their names, dates of birth, and other basic information compromised, but Premier Healthcare says that 1,769 individuals may have had their Social Security numbers or financial information taken as well.

Verizon Enterprise Solutions

March 25, 2016: Verizon Enterprise Solutions, a division of Verizon known for providing IT services and data breach assistance to businesses and government agencies around the world, was hit by hackers who stole the information of about 1.5 million customers. The data was found for sale in an underground cybercrime forum by cybersecurity journalist Brian Krebs. Verizon acknowledged the breach, saying that they've found the security flaw, and are working to contact affected customers.

Systema Software

March 28, 2016: A data breach at California-based Systema Software was not the result of hackers, but an internal error during a system upgrade in which data storage was set up improperly and made publicly available on the Internet. Chris Vickery, a white-hat hacker, found the information online and reported it to the proper authorities - by that point, customer information had been exposed for 75 days. Affected customers include the Kansas State Self Insurance Fund, the CSAC Express Insurance Authority, American All-Risk Loss Administrators/Risico, Millers Mutual Group, Crosswalk Claims Management, and Salt Lake County. Currently, it is not believed that any of the personal information has been used illegally.

Tidewater Community College

March 28, 2016: Current and former employees of Tidewater Community College (TCC) in Norfolk, Virginia had their personal information stolen in a tax season phishing scam. An employee in the school's finance department received a request from a fake TCC e-mail address asking for all employee W-2 information. The individual, not realizing the e-mail was fake, responded with sensitive information including names, earnings, and Social Security numbers. TCC's spokesperson has said that at least 16 TCC employees have reported false tax returns filed under their Social Security numbers.

MedStar Health Inc.

March 30, 2016: The FBI is investigating a computer virus that paralyzed MedStar Health-operated hospitals in Maryland and Washington. Officials are trying to determine whether the virus was ransomware, which holds a company's systems "hostage" until a specific dollar amount is paid. It is not immediately clear whether any patient information was stolen, but with the popularity of medical identity theft among hackers, it is certainly possible that personal data was compromised.

Philippine Commission on Elections

April 11, 2016: A breach of the database for the Philippe Commission on Elections (COMELEC) prompted Infosecurity Magazine to say it "could rank as the worst government data breach anywhere." It is believed that the personal information of every single voter in the Philippines - approximately 55 million people - was compromised on March 27, 2016 by Anonymous; LulzSec Pilipinas published the database online a few days later and those private details are now available online for anyone to steal and engage in all different types of identity theft. Anonymous' actions were allegedly an effort to push COMELEC to turn on security features in the vote counting machines before the national elections on May 9.

Multiple Major E-mail Providers

May 5, 2016: Milwaukee-based Hold Security discovered more than 270 million e-mail usernames and passwords being given away for free in the Russian criminal underground. It is unknown how all of the accounts were stolen, but Hold counted about 57 million Mail.ru accounts, 40 million Yahoo accounts, 33 million Hotmail accounts, and 24 million Gmail addresses. There were also hundreds of thousands of German and Chinese email providers, along with username/password combinations that seem to belong to employees of major banking, manufacturing, and retail companies.

Wendy's

May 11, 2016: In January 2016, Wendy's began investigating a potential data breach after receiving reports of unusual activity involving payment cards at some of their restaurant locations. The details of that investigation became public in May, as the fast food chain revealed that less than 5 percent of its restaurants were affected. The company believes that malware infiltrated one particular point of sale system at fewer than 300 of approximately 5,500 franchised North America Wendy's restaurants, starting in the fall of 2015. Security expert Brian Krebs said many bank and credit unions "have been grumbling about the extent and duration of the breach" and that it seems some breached Wendy's locations were still leaking customer card data as late as the end of March 2016 into early April.

June 16, 2016 Update: In June 2016, Wendy's announced that their data breach was worse than they originally thought. The company did not provide much additional information - only that "additional malicious cyber activity has recently been discovered in some franchise-operated restaurants." They said that they disabled the newly discovered malware, but that "the number of franchise restaurants impacted by these cybersecurity attacks is now expected to be considerably higher than the 300 restaurants already implicated." Wendy's is continuing to work with security experts and federal law enforcement who are investigating the breach. Customers with questions can call 888-846-9467 or email PaymentCardUpdate@wendys.com

LinkedIn

May 17, 2016: A 2012 data breach came back to haunt LinkedIn when 117 million email and password combinations stolen by hackers four years ago popped up online. At the time the breach occurred, members who had been affected were told to reset their passwords. That information then became publicly available in May 2016. LinkedIn acted quickly to invalidate passwords of all LinkedIn accounts that were created prior to the 2012 breach and had not undergone a reset since the breach. It is not clear who stole the information or published it online, but LinkedIn is actively working with law enforcement officials.

Newkirk Products

August 12, 2016: In August 2016, Newkirk Products, a service provider that issues healthcare ID cards, announced a data breach that may have affected up to 3.3 million people. Unknown hackers were able to gain access to a server that contained sensitive member information, including names, mailing addresses, dates of birth, and details about health insurance plans. At this time, it does not appear that any of the stolen information has been used maliciously.

Oracle

August 12, 2016: The company that owns the MICROS point-of-sale system, used in more than 330,000 cash registers around the world, became the victim of a data breach, which was announced to the public in August of 2016. At the time the breach was uncovered by security expert Brian Krebs, it was unclear as to the size and scope; Krebs did say that a large Russian cybercrime group was likely to blame and that they had placed malware on company computers and on the MICROS customer support portal to steal usernames and passwords. Many experts also believe the hackers were probably able to plant malware in the MICROS point-of-sale systems and that they could be responsible for major data breaches at retailers around the country.

Dropbox

September 2, 2016: The popular file-hosting service was forced to confront a data breach from four years ago that affected more users than originally believed. In 2012, Dropbox helped a small amount of users secure their accounts after some usernames were stolen. At the end of August 2016, however, it was revealed that more than 68 million Dropbox users had their usernames and passwords compromised in that initial breach. It does not look like the accounts have been illegally accessed at this time, and all Dropbox users who have not reset their passwords since 2012 have been prompted by the company to do so.

Yahoo!

September 22, 2016: In what may be the most expansive data breach of all time, Yahoo announced that a hacker had stolen information from a minimum of 500 million accounts in late 2014. The thief, believed to be working on behalf of a foreign government, stole e-mail addresses, passwords, full user names, dates of birth, telephone numbers, and in some cases, security questions and answers. At the time of the breach announcement, Yahoo was still working with law enforcement and the FBI on an investigation.

Weebly

October 20, 2016: Over 43 million Weebly users were notified about a data breach that happened in February, but was just discovered in October. Stolen data included usernames, passwords, e-mail addresses, and IP information, but Weebly does not believe any type of financial information was stolen because it does not store full credit card numbers on its servers. Hackers were not able to log directly into customer websites because passwords were protected by bcrypt hashing.

National Payment Corporation of India

October 20, 2016: The National Payment Corporation of India (NPCI) was notified by international banks, primarily in the U.S. and China, that some of its customers' debit cards were being used illegally. Experts believe the breach began with a malware attack that originated at an ATM. The NPCI said that 32 lakh debit cards across 19 Indian banks were compromised, but customers were contacted to change the debit card PINs and customers they couldn't reach had their cards canceled and were issued new ones.

Cisco

November 3, 2016: An incorrect security setting on the mobile version of Cisco's "Professional Careers" website created a privacy hole that exposed the personal information of job-seekers. Discovered by an independent researcher, the security vulnerability made sensitive data available between August and September 2015, and again from July to August 2016. That data included names, addresses, e-mails, phone numbers, usernames, passwords, answers to security questions, resumes, cover letters, and voluntary information such as gender, race, veteran status, and disability.

At this time, there is no evidence that any other parties accessed the job-seekers' information, other than the independent researcher. Cisco did say, however, that "there was an instance of unexplained, anomalous connection to the server during that time, so we are taking precautionary steps." Those steps include alerting all Cisco job-seekers to the breach, requiring all users to reset their passwords, and offering to put 90-day fraud alerts on accounts for interested users.

AdultFriendFinder.com

November 13, 2016: AdultFriendFinder, an X-rated website, was targeted by hackers for the second time in two years. This time, though, the amount of accounts compromised was immense - approximately 412 million users had personal information stolen and published in online criminal marketplaces. The breached data included e-mail addresses, passwords, VIP member status, browser info, last IP address to log in, and purchases. LeakedSource is responsible for finding and reporting the breach to the public; AdultFriendFinder has only admitted to finding a vulnerability and has not confirmed the attack yet.

San Francisco Municipal Transportation Agency

November 25, 2016: San Francisco's public railway system, known as Muni, was infected with malware over the Thanksgiving weekend; this resulted in locked kiosks and computers and two days of free rides for passengers until the system went back online on Sunday, November 27. reached out to the hackers, who said the attack was not targeted - it was an automated attack, also known as a "spray and pray." In this type of attack, an automated system sends links to malware out to many prospective victims; an IT admin at the transportation agency allegedly clicked on the link and unknowingly downloaded the malware files.

The hackers claim to have 30GB of stolen data, which includes the personal information of employees and riders. They want the agency to fix its vulnerable systems and pay a ransom of 100 Bitcoins, or about $73,000 - if their demands aren't met, they say they will release all of the personal information. The agency's systems are back online, but as of now, it does not appear that they have paid the hackers.

Yahoo

December 14, 2016: Less than three months after announcing a 2014 data breach that affected 500 million users, Yahoo did it again - and even bigger than before. In December, the company discovered another breach from 2013 that may have compromised the personal information of one billion Yahoo accounts, making it the largest data breach in history. At the time of the breach announcement, Yahoo did not have much additional information to share with the public, as it was still unclear who was responsible, how they got into the system, and what they stole.

# data[].attributes.attachment_link.description
2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

# data[].attributes.body
Hackers

# data[].attributes.attachment_link.provider_name
We Aren't Just Protecting You From Identity Theft. We Protect Who You Are.

# data[].attributes.attachment_link.readable_text
Posted on December 16, 2016 by Judy Leary in Data Breach & Technology, Personal

2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

You may also be interested in:

FACC

January 25, 2016: FACC, an Austrian-based aerospace parts manufacturer (with clients like Airbus and Boeing), announced they fell victim to hackers in January 2016. The criminals, however, seemed to ignore the company's data and intellectual property, opting to instead steal approximately €50 million - which is equivalent to about $54.5 million U.S. dollars. FACC says that while they are investigating the extent of the damage and how it happened, their normal operations have not been affected.

University of Central Florida

February 8, 2016: At the beginning of February 2016, the University of Central Florida announced a data breach that affected approximately 63,000 current and former students, faculty, and staff. The breach was discovered in January, but before making the incident public, the university reported it to law enforcement and conducted an internal investigation. Unknown cyber criminals compromised the university's computer system and stole a variety of information including Social Security numbers, first and last names, and student/employee ID numbers.

U.S. Department of Justice

February 9, 2016: Hackers angry about U.S. relations with Israel tried to call attention to their cause in February 2016 by breaching the U.S. Department of Justice's database. CNN reported the hackers released data on 10,000 Department of Homeland Security employees one day, and then released data on 20,000 FBI employees the next day. Information stolen included names, titles, phone numbers, and e-mail addresses; the Department of Justice does not believe that any sensitive information, like Social Security numbers, was obtained. Tweeting from the account @DotGovs, the hackers said it took one week for the Department of Justice to realize that their systems had been compromised.

Internal Revenue Service

February 29, 2016: The Internal Revenue Service (IRS) announced that the data breach they uncovered in May 2015 was much larger than initially believed. In May, the IRS said over 100,000 American taxpayers had their personal information compromised when the agency's "Get Transcript" system was hacked. However, in February 2016, those numbers have been increased to over 700,000. The IRS thinks a sophisticated Russia-based criminal operation is responsible for the data breach and that identities were stolen to file fraudulent tax returns in the future.

UC Berkeley

February 29, 2016: The financial data of more than 80,000 University of California, Berkeley students, alumni, employees, and school officials was compromised around December 2015 and announced to the public in February 2016. The school says that although it was clear their system was hacked, it does not appear that any information was stolen. Those who may have been affected were notified and encouraged to keep an eye on their personal information.

Snapchat

March 3, 2016: 700 current and former Snapchat employees had their personal information stolen when hackers used a phishing scam to trick an employee into e-mailing them the private data. Posing as Snapchat chief executive Evan Spiegel, the attackers simply requested - and received - sensitive employee information including names, Social Security numbers, and wage/payroll data. It is presently unclear who is responsible for the attack or how they may use the information they stole.

21st Century Oncology

March 10, 2016: 21 st Century Oncology, a Fort Myers-based company offering cancer care services, revealed in a statement on their website that 2.2 million patients may have had personal information stolen when the company's system was breached in October 2015. The breach was discovered in November 2015, but the FBI discouraged the company from making a public announcement until March, as the investigation was ongoing. Though there is no evidence that the data has been used in any way, hackers did have access to patient names, Social Security numbers, doctor names, diagnosis and treatment information, and insurance information.

Premier Healthcare

March 10, 2016: A data breach was reported by Premier Healthcare, a multispecialty provider healthcare group, after a laptop computer was stolen from the billing department of their Bloomington, Indiana headquarters. The laptop was protected by a password, but it was not encrypted and contained sensitive data pertaining to more than 200,000 patients. Most victims affected had their names, dates of birth, and other basic information compromised, but Premier Healthcare says that 1,769 individuals may have had their Social Security numbers or financial information taken as well.

Verizon Enterprise Solutions

March 25, 2016: Verizon Enterprise Solutions, a division of Verizon known for providing IT services and data breach assistance to businesses and government agencies around the world, was hit by hackers who stole the information of about 1.5 million customers. The data was found for sale in an underground cybercrime forum by cybersecurity journalist Brian Krebs. Verizon acknowledged the breach, saying that they've found the security flaw, and are working to contact affected customers.

Systema Software

March 28, 2016: A data breach at California-based Systema Software was not the result of hackers, but an internal error during a system upgrade in which data storage was set up improperly and made publicly available on the Internet. Chris Vickery, a white-hat hacker, found the information online and reported it to the proper authorities - by that point, customer information had been exposed for 75 days. Affected customers include the Kansas State Self Insurance Fund, the CSAC Express Insurance Authority, American All-Risk Loss Administrators/Risico, Millers Mutual Group, Crosswalk Claims Management, and Salt Lake County. Currently, it is not believed that any of the personal information has been used illegally.

Tidewater Community College

March 28, 2016: Current and former employees of Tidewater Community College (TCC) in Norfolk, Virginia had their personal information stolen in a tax season phishing scam. An employee in the school's finance department received a request from a fake TCC e-mail address asking for all employee W-2 information. The individual, not realizing the e-mail was fake, responded with sensitive information including names, earnings, and Social Security numbers. TCC's spokesperson has said that at least 16 TCC employees have reported false tax returns filed under their Social Security numbers.

MedStar Health Inc.

March 30, 2016: The FBI is investigating a computer virus that paralyzed MedStar Health-operated hospitals in Maryland and Washington. Officials are trying to determine whether the virus was ransomware, which holds a company's systems "hostage" until a specific dollar amount is paid. It is not immediately clear whether any patient information was stolen, but with the popularity of medical identity theft among hackers, it is certainly possible that personal data was compromised.

Philippine Commission on Elections

April 11, 2016: A breach of the database for the Philippe Commission on Elections (COMELEC) prompted Infosecurity Magazine to say it "could rank as the worst government data breach anywhere." It is believed that the personal information of every single voter in the Philippines - approximately 55 million people - was compromised on March 27, 2016 by Anonymous; LulzSec Pilipinas published the database online a few days later and those private details are now available online for anyone to steal and engage in all different types of identity theft. Anonymous' actions were allegedly an effort to push COMELEC to turn on security features in the vote counting machines before the national elections on May 9.

Multiple Major E-mail Providers

May 5, 2016: Milwaukee-based Hold Security discovered more than 270 million e-mail usernames and passwords being given away for free in the Russian criminal underground. It is unknown how all of the accounts were stolen, but Hold counted about 57 million Mail.ru accounts, 40 million Yahoo accounts, 33 million Hotmail accounts, and 24 million Gmail addresses. There were also hundreds of thousands of German and Chinese email providers, along with username/password combinations that seem to belong to employees of major banking, manufacturing, and retail companies.

Wendy's

May 11, 2016: In January 2016, Wendy's began investigating a potential data breach after receiving reports of unusual activity involving payment cards at some of their restaurant locations. The details of that investigation became public in May, as the fast food chain revealed that less than 5 percent of its restaurants were affected. The company believes that malware infiltrated one particular point of sale system at fewer than 300 of approximately 5,500 franchised North America Wendy's restaurants, starting in the fall of 2015. Security expert Brian Krebs said many bank and credit unions "have been grumbling about the extent and duration of the breach" and that it seems some breached Wendy's locations were still leaking customer card data as late as the end of March 2016 into early April.

June 16, 2016 Update: In June 2016, Wendy's announced that their data breach was worse than they originally thought. The company did not provide much additional information - only that "additional malicious cyber activity has recently been discovered in some franchise-operated restaurants." They said that they disabled the newly discovered malware, but that "the number of franchise restaurants impacted by these cybersecurity attacks is now expected to be considerably higher than the 300 restaurants already implicated." Wendy's is continuing to work with security experts and federal law enforcement who are investigating the breach. Customers with questions can call 888-846-9467 or email PaymentCardUpdate@wendys.com

LinkedIn

May 17, 2016: A 2012 data breach came back to haunt LinkedIn when 117 million email and password combinations stolen by hackers four years ago popped up online. At the time the breach occurred, members who had been affected were told to reset their passwords. That information then became publicly available in May 2016. LinkedIn acted quickly to invalidate passwords of all LinkedIn accounts that were created prior to the 2012 breach and had not undergone a reset since the breach. It is not clear who stole the information or published it online, but LinkedIn is actively working with law enforcement officials.

Newkirk Products

August 12, 2016: In August 2016, Newkirk Products, a service provider that issues healthcare ID cards, announced a data breach that may have affected up to 3.3 million people. Unknown hackers were able to gain access to a server that contained sensitive member information, including names, mailing addresses, dates of birth, and details about health insurance plans. At this time, it does not appear that any of the stolen information has been used maliciously.

Oracle

August 12, 2016: The company that owns the MICROS point-of-sale system, used in more than 330,000 cash registers around the world, became the victim of a data breach, which was announced to the public in August of 2016. At the time the breach was uncovered by security expert Brian Krebs, it was unclear as to the size and scope; Krebs did say that a large Russian cybercrime group was likely to blame and that they had placed malware on company computers and on the MICROS customer support portal to steal usernames and passwords. Many experts also believe the hackers were probably able to plant malware in the MICROS point-of-sale systems and that they could be responsible for major data breaches at retailers around the country.

Dropbox

September 2, 2016: The popular file-hosting service was forced to confront a data breach from four years ago that affected more users than originally believed. In 2012, Dropbox helped a small amount of users secure their accounts after some usernames were stolen. At the end of August 2016, however, it was revealed that more than 68 million Dropbox users had their usernames and passwords compromised in that initial breach. It does not look like the accounts have been illegally accessed at this time, and all Dropbox users who have not reset their passwords since 2012 have been prompted by the company to do so.

Yahoo!

September 22, 2016: In what may be the most expansive data breach of all time, Yahoo announced that a hacker had stolen information from a minimum of 500 million accounts in late 2014. The thief, believed to be working on behalf of a foreign government, stole e-mail addresses, passwords, full user names, dates of birth, telephone numbers, and in some cases, security questions and answers. At the time of the breach announcement, Yahoo was still working with law enforcement and the FBI on an investigation.

Weebly

October 20, 2016: Over 43 million Weebly users were notified about a data breach that happened in February, but was just discovered in October. Stolen data included usernames, passwords, e-mail addresses, and IP information, but Weebly does not believe any type of financial information was stolen because it does not store full credit card numbers on its servers. Hackers were not able to log directly into customer websites because passwords were protected by bcrypt hashing.

National Payment Corporation of India

October 20, 2016: The National Payment Corporation of India (NPCI) was notified by international banks, primarily in the U.S. and China, that some of its customers' debit cards were being used illegally. Experts believe the breach began with a malware attack that originated at an ATM. The NPCI said that 32 lakh debit cards across 19 Indian banks were compromised, but customers were contacted to change the debit card PINs and customers they couldn't reach had their cards canceled and were issued new ones.

Cisco

November 3, 2016: An incorrect security setting on the mobile version of Cisco's "Professional Careers" website created a privacy hole that exposed the personal information of job-seekers. Discovered by an independent researcher, the security vulnerability made sensitive data available between August and September 2015, and again from July to August 2016. That data included names, addresses, e-mails, phone numbers, usernames, passwords, answers to security questions, resumes, cover letters, and voluntary information such as gender, race, veteran status, and disability.

At this time, there is no evidence that any other parties accessed the job-seekers' information, other than the independent researcher. Cisco did say, however, that "there was an instance of unexplained, anomalous connection to the server during that time, so we are taking precautionary steps." Those steps include alerting all Cisco job-seekers to the breach, requiring all users to reset their passwords, and offering to put 90-day fraud alerts on accounts for interested users.

AdultFriendFinder.com

November 13, 2016: AdultFriendFinder, an X-rated website, was targeted by hackers for the second time in two years. This time, though, the amount of accounts compromised was immense - approximately 412 million users had personal information stolen and published in online criminal marketplaces. The breached data included e-mail addresses, passwords, VIP member status, browser info, last IP address to log in, and purchases. LeakedSource is responsible for finding and reporting the breach to the public; AdultFriendFinder has only admitted to finding a vulnerability and has not confirmed the attack yet.

San Francisco Municipal Transportation Agency

November 25, 2016: San Francisco's public railway system, known as Muni, was infected with malware over the Thanksgiving weekend; this resulted in locked kiosks and computers and two days of free rides for passengers until the system went back online on Sunday, November 27. reached out to the hackers, who said the attack was not targeted - it was an automated attack, also known as a "spray and pray." In this type of attack, an automated system sends links to malware out to many prospective victims; an IT admin at the transportation agency allegedly clicked on the link and unknowingly downloaded the malware files.

The hackers claim to have 30GB of stolen data, which includes the personal information of employees and riders. They want the agency to fix its vulnerable systems and pay a ransom of 100 Bitcoins, or about $73,000 - if their demands aren't met, they say they will release all of the personal information. The agency's systems are back online, but as of now, it does not appear that they have paid the hackers.

Yahoo

December 14, 2016: Less than three months after announcing a 2014 data breach that affected 500 million users, Yahoo did it again - and even bigger than before. In December, the company discovered another breach from 2013 that may have compromised the personal information of one billion Yahoo accounts, making it the largest data breach in history. At the time of the breach announcement, Yahoo did not have much additional information to share with the public, as it was still unclear who was responsible, how they got into the system, and what they stole.

# data[].attributes.attachment_link.description
2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

# data[].attributes.body
Malware

# data[].attributes.attachment_link.provider_name
We Aren't Just Protecting You From Identity Theft. We Protect Who You Are.

# data[].attributes.attachment_link.readable_text
Posted on December 16, 2016 by Judy Leary in Data Breach & Technology, Personal

2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.

You may also be interested in:

FACC

January 25, 2016: FACC, an Austrian-based aerospace parts manufacturer (with clients like Airbus and Boeing), announced they fell victim to hackers in January 2016. The criminals, however, seemed to ignore the company's data and intellectual property, opting to instead steal approximately €50 million - which is equivalent to about $54.5 million U.S. dollars. FACC says that while they are investigating the extent of the damage and how it happened, their normal operations have not been affected.

University of Central Florida

February 8, 2016: At the beginning of February 2016, the University of Central Florida announced a data breach that affected approximately 63,000 current and former students, faculty, and staff. The breach was discovered in January, but before making the incident public, the university reported it to law enforcement and conducted an internal investigation. Unknown cyber criminals compromised the university's computer system and stole a variety of information including Social Security numbers, first and last names, and student/employee ID numbers.

U.S. Department of Justice

February 9, 2016: Hackers angry about U.S. relations with Israel tried to call attention to their cause in February 2016 by breaching the U.S. Department of Justice's database. CNN reported the hackers released data on 10,000 Department of Homeland Security employees one day, and then released data on 20,000 FBI employees the next day. Information stolen included names, titles, phone numbers, and e-mail addresses; the Department of Justice does not believe that any sensitive information, like Social Security numbers, was obtained. Tweeting from the account @DotGovs, the hackers said it took one week for the Department of Justice to realize that their systems had been compromised.

Internal Revenue Service

February 29, 2016: The Internal Revenue Service (IRS) announced that the data breach they uncovered in May 2015 was much larger than initially believed. In May, the IRS said over 100,000 American taxpayers had their personal information compromised when the agency's "Get Transcript" system was hacked. However, in February 2016, those numbers have been increased to over 700,000. The IRS thinks a sophisticated Russia-based criminal operation is responsible for the data breach and that identities were stolen to file fraudulent tax returns in the future.

UC Berkeley

February 29, 2016: The financial data of more than 80,000 University of California, Berkeley students, alumni, employees, and school officials was compromised around December 2015 and announced to the public in February 2016. The school says that although it was clear their system was hacked, it does not appear that any information was stolen. Those who may have been affected were notified and encouraged to keep an eye on their personal information.

Snapchat

March 3, 2016: 700 current and former Snapchat employees had their personal information stolen when hackers used a phishing scam to trick an employee into e-mailing them the private data. Posing as Snapchat chief executive Evan Spiegel, the attackers simply requested - and received - sensitive employee information including names, Social Security numbers, and wage/payroll data. It is presently unclear who is responsible for the attack or how they may use the information they stole.

21st Century Oncology

March 10, 2016: 21 st Century Oncology, a Fort Myers-based company offering cancer care services, revealed in a statement on their website that 2.2 million patients may have had personal information stolen when the company's system was breached in October 2015. The breach was discovered in November 2015, but the FBI discouraged the company from making a public announcement until March, as the investigation was ongoing. Though there is no evidence that the data has been used in any way, hackers did have access to patient names, Social Security numbers, doctor names, diagnosis and treatment information, and insurance information.

Premier Healthcare

March 10, 2016: A data breach was reported by Premier Healthcare, a multispecialty provider healthcare group, after a laptop computer was stolen from the billing department of their Bloomington, Indiana headquarters. The laptop was protected by a password, but it was not encrypted and contained sensitive data pertaining to more than 200,000 patients. Most victims affected had their names, dates of birth, and other basic information compromised, but Premier Healthcare says that 1,769 individuals may have had their Social Security numbers or financial information taken as well.

Verizon Enterprise Solutions

March 25, 2016: Verizon Enterprise Solutions, a division of Verizon known for providing IT services and data breach assistance to businesses and government agencies around the world, was hit by hackers who stole the information of about 1.5 million customers. The data was found for sale in an underground cybercrime forum by cybersecurity journalist Brian Krebs. Verizon acknowledged the breach, saying that they've found the security flaw, and are working to contact affected customers.

Systema Software

March 28, 2016: A data breach at California-based Systema Software was not the result of hackers, but an internal error during a system upgrade in which data storage was set up improperly and made publicly available on the Internet. Chris Vickery, a white-hat hacker, found the information online and reported it to the proper authorities - by that point, customer information had been exposed for 75 days. Affected customers include the Kansas State Self Insurance Fund, the CSAC Express Insurance Authority, American All-Risk Loss Administrators/Risico, Millers Mutual Group, Crosswalk Claims Management, and Salt Lake County. Currently, it is not believed that any of the personal information has been used illegally.

Tidewater Community College

March 28, 2016: Current and former employees of Tidewater Community College (TCC) in Norfolk, Virginia had their personal information stolen in a tax season phishing scam. An employee in the school's finance department received a request from a fake TCC e-mail address asking for all employee W-2 information. The individual, not realizing the e-mail was fake, responded with sensitive information including names, earnings, and Social Security numbers. TCC's spokesperson has said that at least 16 TCC employees have reported false tax returns filed under their Social Security numbers.

MedStar Health Inc.

March 30, 2016: The FBI is investigating a computer virus that paralyzed MedStar Health-operated hospitals in Maryland and Washington. Officials are trying to determine whether the virus was ransomware, which holds a company's systems "hostage" until a specific dollar amount is paid. It is not immediately clear whether any patient information was stolen, but with the popularity of medical identity theft among hackers, it is certainly possible that personal data was compromised.

Philippine Commission on Elections

April 11, 2016: A breach of the database for the Philippe Commission on Elections (COMELEC) prompted Infosecurity Magazine to say it "could rank as the worst government data breach anywhere." It is believed that the personal information of every single voter in the Philippines - approximately 55 million people - was compromised on March 27, 2016 by Anonymous; LulzSec Pilipinas published the database online a few days later and those private details are now available online for anyone to steal and engage in all different types of identity theft. Anonymous' actions were allegedly an effort to push COMELEC to turn on security features in the vote counting machines before the national elections on May 9.

Multiple Major E-mail Providers

May 5, 2016: Milwaukee-based Hold Security discovered more than 270 million e-mail usernames and passwords being given away for free in the Russian criminal underground. It is unknown how all of the accounts were stolen, but Hold counted about 57 million Mail.ru accounts, 40 million Yahoo accounts, 33 million Hotmail accounts, and 24 million Gmail addresses. There were also hundreds of thousands of German and Chinese email providers, along with username/password combinations that seem to belong to employees of major banking, manufacturing, and retail companies.

Wendy's

May 11, 2016: In January 2016, Wendy's began investigating a potential data breach after receiving reports of unusual activity involving payment cards at some of their restaurant locations. The details of that investigation became public in May, as the fast food chain revealed that less than 5 percent of its restaurants were affected. The company believes that malware infiltrated one particular point of sale system at fewer than 300 of approximately 5,500 franchised North America Wendy's restaurants, starting in the fall of 2015. Security expert Brian Krebs said many bank and credit unions "have been grumbling about the extent and duration of the breach" and that it seems some breached Wendy's locations were still leaking customer card data as late as the end of March 2016 into early April.

June 16, 2016 Update: In June 2016, Wendy's announced that their data breach was worse than they originally thought. The company did not provide much additional information - only that "additional malicious cyber activity has recently been discovered in some franchise-operated restaurants." They said that they disabled the newly discovered malware, but that "the number of franchise restaurants impacted by these cybersecurity attacks is now expected to be considerably higher than the 300 restaurants already implicated." Wendy's is continuing to work with security experts and federal law enforcement who are investigating the breach. Customers with questions can call 888-846-9467 or email PaymentCardUpdate@wendys.com

LinkedIn

May 17, 2016: A 2012 data breach came back to haunt LinkedIn when 117 million email and password combinations stolen by hackers four years ago popped up online. At the time the breach occurred, members who had been affected were told to reset their passwords. That information then became publicly available in May 2016. LinkedIn acted quickly to invalidate passwords of all LinkedIn accounts that were created prior to the 2012 breach and had not undergone a reset since the breach. It is not clear who stole the information or published it online, but LinkedIn is actively working with law enforcement officials.

Newkirk Products

August 12, 2016: In August 2016, Newkirk Products, a service provider that issues healthcare ID cards, announced a data breach that may have affected up to 3.3 million people. Unknown hackers were able to gain access to a server that contained sensitive member information, including names, mailing addresses, dates of birth, and details about health insurance plans. At this time, it does not appear that any of the stolen information has been used maliciously.

Oracle

August 12, 2016: The company that owns the MICROS point-of-sale system, used in more than 330,000 cash registers around the world, became the victim of a data breach, which was announced to the public in August of 2016. At the time the breach was uncovered by security expert Brian Krebs, it was unclear as to the size and scope; Krebs did say that a large Russian cybercrime group was likely to blame and that they had placed malware on company computers and on the MICROS customer support portal to steal usernames and passwords. Many experts also believe the hackers were probably able to plant malware in the MICROS point-of-sale systems and that they could be responsible for major data breaches at retailers around the country.

Dropbox

September 2, 2016: The popular file-hosting service was forced to confront a data breach from four years ago that affected more users than originally believed. In 2012, Dropbox helped a small amount of users secure their accounts after some usernames were stolen. At the end of August 2016, however, it was revealed that more than 68 million Dropbox users had their usernames and passwords compromised in that initial breach. It does not look like the accounts have been illegally accessed at this time, and all Dropbox users who have not reset their passwords since 2012 have been prompted by the company to do so.

Yahoo!

September 22, 2016: In what may be the most expansive data breach of all time, Yahoo announced that a hacker had stolen information from a minimum of 500 million accounts in late 2014. The thief, believed to be working on behalf of a foreign government, stole e-mail addresses, passwords, full user names, dates of birth, telephone numbers, and in some cases, security questions and answers. At the time of the breach announcement, Yahoo was still working with law enforcement and the FBI on an investigation.

Weebly

October 20, 2016: Over 43 million Weebly users were notified about a data breach that happened in February, but was just discovered in October. Stolen data included usernames, passwords, e-mail addresses, and IP information, but Weebly does not believe any type of financial information was stolen because it does not store full credit card numbers on its servers. Hackers were not able to log directly into customer websites because passwords were protected by bcrypt hashing.

National Payment Corporation of India

October 20, 2016: The National Payment Corporation of India (NPCI) was notified by international banks, primarily in the U.S. and China, that some of its customers' debit cards were being used illegally. Experts believe the breach began with a malware attack that originated at an ATM. The NPCI said that 32 lakh debit cards across 19 Indian banks were compromised, but customers were contacted to change the debit card PINs and customers they couldn't reach had their cards canceled and were issued new ones.

Cisco

November 3, 2016: An incorrect security setting on the mobile version of Cisco's "Professional Careers" website created a privacy hole that exposed the personal information of job-seekers. Discovered by an independent researcher, the security vulnerability made sensitive data available between August and September 2015, and again from July to August 2016. That data included names, addresses, e-mails, phone numbers, usernames, passwords, answers to security questions, resumes, cover letters, and voluntary information such as gender, race, veteran status, and disability.

At this time, there is no evidence that any other parties accessed the job-seekers' information, other than the independent researcher. Cisco did say, however, that "there was an instance of unexplained, anomalous connection to the server during that time, so we are taking precautionary steps." Those steps include alerting all Cisco job-seekers to the breach, requiring all users to reset their passwords, and offering to put 90-day fraud alerts on accounts for interested users.

AdultFriendFinder.com

November 13, 2016: AdultFriendFinder, an X-rated website, was targeted by hackers for the second time in two years. This time, though, the amount of accounts compromised was immense - approximately 412 million users had personal information stolen and published in online criminal marketplaces. The breached data included e-mail addresses, passwords, VIP member status, browser info, last IP address to log in, and purchases. LeakedSource is responsible for finding and reporting the breach to the public; AdultFriendFinder has only admitted to finding a vulnerability and has not confirmed the attack yet.

San Francisco Municipal Transportation Agency

November 25, 2016: San Francisco's public railway system, known as Muni, was infected with malware over the Thanksgiving weekend; this resulted in locked kiosks and computers and two days of free rides for passengers until the system went back online on Sunday, November 27. reached out to the hackers, who said the attack was not targeted - it was an automated attack, also known as a "spray and pray." In this type of attack, an automated system sends links to malware out to many prospective victims; an IT admin at the transportation agency allegedly clicked on the link and unknowingly downloaded the malware files.

The hackers claim to have 30GB of stolen data, which includes the personal information of employees and riders. They want the agency to fix its vulnerable systems and pay a ransom of 100 Bitcoins, or about $73,000 - if their demands aren't met, they say they will release all of the personal information. The agency's systems are back online, but as of now, it does not appear that they have paid the hackers.

Yahoo

December 14, 2016: Less than three months after announcing a 2014 data breach that affected 500 million users, Yahoo did it again - and even bigger than before. In December, the company discovered another breach from 2013 that may have compromised the personal information of one billion Yahoo accounts, making it the largest data breach in history. At the time of the breach announcement, Yahoo did not have much additional information to share with the public, as it was still unclear who was responsible, how they got into the system, and what they stole.

# data[].attributes.attachment_link.description
2015 saw some of the largest data breaches ever, and while companies continue to fight the good fight against hackers and identity theft, we have no doubt 2016 will bring some breaches no one could never expect. Here are some major 2016 breaches from around the world that are important to be aware of.