Vector: Unknown threat actor gained unauthorized access to Hasbro's corporate IT network and exfiltrated data before being detected; Hasbro took systems offline to contain the spread, disrupting some business operations; specific initial access vector was not publicly disclosed at time of reporting

Vector: Smart contract exploit / hack

Vector: WorldLeaks extortion gang breached a third-party discovery transfer system used by the Los Angeles City Attorney's Office to transfer legal discovery documents; LAPD's own systems and networks were not directly compromised

Vector: AppsFlyer's mobile attribution SDK — embedded in thousands of iOS and Android applications — was compromised; attackers used malicious SDK code to intercept cryptocurrency wallet addresses in apps that used AppsFlyer for mobile marketing attribution

Vector: Unknown attacker compromised a Washington State-based employee benefits administrator's systems, accessing employer and employee benefits enrollment data

Vector: ShinyHunters used targeted vishing (voice phishing) against a single Aura employee to obtain credentials, gaining approximately one hour of unauthorized access before being detected and removed

Vector: Unauthorized actor gained access to one of CareCloud's six electronic health record (EHR) environments; initial access vector not publicly disclosed

Vector: Smart contract exploit / hack

Vector: Seed phrase / wallet compromise

Vector: Unknown attacker gained unauthorized access to the California-based implantable orthopedic device manufacturer's systems; the company reported the hacking incident to relevant authorities and is among several medical device makers to disclose cybersecurity incidents in early 2026

Vector: Unknown attacker gained unauthorized access to Dutch Ministry of Finance (Rijksfinancien) systems; the specific attack vector — whether phishing, exploitation of an internet-facing vulnerability, or supply chain — was not confirmed at time of initial reporting

Vector: Customer data belonging to Lloyds Banking Group was exposed or leaked; the specific mechanism — whether a direct breach of Lloyds systems, a third-party vendor incident, or an insider leak — was not confirmed at time of initial reporting; approximately 450,000 customer records were involved

Vector: Seed phrase / wallet compromise

Vector: Unknown attacker gained unauthorized access to UFP Technologies' systems and exfiltrated data; UFP filed an SEC 8-K cybersecurity incident notification

Vector: A coding error in PayPal's application enabled unauthorized data access and facilitated fraud against a subset of PayPal users; the error was in the app's data handling logic rather than a direct attack by external threat actors

Vector: Oracle price manipulation

Vector: Ponzi / pyramid scheme

Vector: Interlock ransomware group exploited vulnerabilities in Kettering Health's network infrastructure

Vector: ShinyHunters used phishing and social engineering to gain access to Odido's customer contact/CRM system used by customer service representatives

Vector: Former Nuance Communications IT employee retained access to healthcare client systems after termination; used former access credentials to access Geisinger Health patient data

Vector: ShinyHunters' vishing (voice phishing) social engineering campaign targeting cloud service providers; victims included service providers holding Harvard and UPenn alumni, donor, or student data

Vector: Misconfiguration: Transformco (Sears Home Services parent) left three cloud storage buckets containing AI chatbot logs, audio recordings, and scheduling data publicly accessible without authentication

Vector: ShinyHunters used social engineering (pretexting/vishing — impersonating employees calling the help desk for password resets) to gain unauthorized access to CarGurus systems

Vector: Unknown; hackers claimed access to government and law firm user data

Vector: Unknown attacker compromised ambulance billing and collections firm systems accessing patient data

Vector: Unknown attacker compromised a Maryland-based firm providing AI-powered services; the firm stores personal data from healthcare or insurance-related AI processing workflows

Vector: ShinyHunters used vishing (voice phishing) to impersonate employees calling IT/help desk and obtain Okta SSO credentials, gaining unauthorized access to Crunchbase systems

Vector: Vishing (voice phishing) attack compromised a contractor's account at Bumble, granting limited access to internal Slack and Google Drive systems; a related attack targeted Match Group

Vector: Voice phishing (vishing) social engineering attack tricked an employee into surrendering credentials and MFA codes, allowing unauthorized access to internal systems

Vector: Smart contract exploit / hack

Vector: Broken Object Level Authorization (BOLA) vulnerability in Navia's systems allowed unauthorized access to benefit plan data

Vector: Insecure Direct Object Reference (IDOR) vulnerabilities and broken access controls in Condé Nast's centralized identity/account platform allowed unauthenticated enumeration of user profiles by iterating user ID values

Vector: Address poisoning attack

Vector: Unknown; Crimson Collective threat actor claimed access to Brightspeed's systems and exfiltration of over 1 million customer records; Brightspeed confirmed an investigation into a potential cybersecurity event

Vector: Unauthorized access to Global-e's cloud system storing order data for multiple brands including Ledger; initial access vector not publicly disclosed

Vector: Unauthorized access via abnormal API/application requests on doctor accounts in Cegedim Santé's MonLogicielMedical (MLM) cloud healthcare platform; initial access vector not publicly disclosed

Vector: Unknown; no encrypting malware was involved; SitusAMC described it as a contained data exfiltration incident

Vector: Insider threat: a former Coupang employee retained unauthorized access to internal systems and exfiltrated customer data; breach persisted until November 8, 2025, per South Korean government investigation

Vector: Withdrawal halt / insolvency

Vector: An unnamed third-party vendor used by Freedom Mobile was compromised, exposing customer account data stored in the vendor's systems

Vector: Marquis Software Solutions, a vendor providing core banking software to community banks and credit unions, was compromised, exposing customer financial data for clients of 74 affected financial institutions

Vector: Social engineering attack targeting a DoorDash employee; threat actors manipulated the employee to gain access to internal systems

Vector: A third-party vendor used by Iberia was compromised, exposing customer loyalty programme data

Vector: Threat actor compromised an unnamed third-party customer service provider used by Discord, gaining access to customer support data including user account information

Vector: Attackers used valid credentials to access and clone third-party partner repositories used in DocketWise's data migration pipeline, which contained unstructured client data belonging to immigration law firms

Vector: Attackers exploited a vulnerability in Oracle E-Business Suite (ERP system) used by The Washington Post for HR and payroll management, exfiltrating employee and contractor personal and financial data

Vector: Nation-state attack (Lazarus/DPRK) — private key or social engineering compromise

Vector: Phishing attack

Vector: MANGO's third-party marketing service provider was compromised, exposing customer contact and demographic data used for marketing campaigns

Vector: Flash loan attack on smart contract

Vector: Smart contract exploit / hack

Vector: Threat actors compromised Kiln, a professional crypto staking infrastructure provider, and used their access to drain Solana (SOL) funds belonging to SwissBorg customers from the Kiln-managed Solana Earn product

Vector: ShinyHunters exploited a vulnerability in Wynn Resorts' Oracle PeopleSoft HR platform to gain unauthorized access and exfiltrate employee data

Vector: A third-party vendor used by Renault and Dacia UK was compromised, exposing customer personal data including vehicle identification information

Vector: A user affiliated with a licensed healthcare provider accessed the MnCHOICES disability services system without authorization; unauthorized access occurred through a third-party vendor (FEI Systems) managing the platform

Vector: An unnamed third-party vendor used by LNER was compromised, exposing customer contact details and journey information stored in the vendor's systems

Vector: A third-party vendor used by Wealthsimple was compromised, exposing sensitive personal and financial identity documents for affected customers

Vector: Smart contract exploit / hack

Vector: MEV / sandwich attack

Vector: Cyberattack on Bouygues Telecom systems; specific initial access vector not publicly disclosed

Vector: Attackers exploited CVE-2025-61882, a zero-day vulnerability in Oracle E-Business Suite (EBS), to access the university's network and exfiltrate sensitive data; attack tactics consistent with Clop ransomware gang

Vector: Threat actors compromised 2Keys Corporation, a third-party digital identity service provider contracted by the Canadian federal government, gaining access to authentication data for government service accounts

Vector: Chess.com's unnamed third-party file transfer provider was compromised, resulting in the exfiltration of customer data stored in that system

Vector: A third-party vendor used by Harrods for customer relationship management was compromised, exposing online customer contact details

Vector: Attackers (attributed to ShinyHunters/UNC6395) gained access to a third-party Salesforce-based application used by TransUnion for US consumer support operations, likely via the SalesLoft Drift OAuth token supply chain attack

Vector: Phishing attack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Attackers compromised a partner's system in July 2025 and gained unauthorized access to a third-party API linked to 700Credit's web application, likely via web application vulnerability or misconfiguration

Vector: Third-party AI chatbot provider Paradox, Inc. used by McDonald's for automated job application processing was compromised, exposing applicant data collected through the hiring platform

Vector: Routine code update to the PayPal Working Capital (PPWC) loan application contained a programming error that left customer PII accessible without authorization for approximately six months

Vector: ShinyHunters compromised Air France-KLM's Salesforce CRM environment through social engineering / vishing of a Salesforce-privileged employee, part of the broader 2025 ShinyHunters Salesforce campaign

Vector: ShinyHunters compromised TransUnion's Salesforce environment through social engineering / vishing of a Salesforce-privileged user, part of the broader 2025 Scattered Spider/ShinyHunters Salesforce campaign targeting major enterprises

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Ponzi / pyramid scheme

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Social engineering / vishing (voice phishing): attackers impersonated employees to deceive IT help desk into granting account access

Vector: Smart contract exploit / hack

Vector: On-chain theft (attributed by zachxbt)

Vector: Attackers used compromised credentials (likely a service account or employee login) to access Prosper's internal databases and issue unauthorized queries to extract customer data over approximately 3 months

Vector: Scattered Lapsus$ Hunters (ShinyHunters) breached Vietnam Airlines' Salesforce CRM instance as part of a campaign targeting 39+ companies via malicious OAuth app linked through vishing of employees

Vector: DNS hijacking / domain takeover (front-end compromise)

Vector: Scattered Spider (UNC3944) conducted a social engineering / vishing attack targeting Tata Consultancy Services (TCS) employees who had privileged access to M&S systems, gaining access to M&S Active Directory via NTLM hash relay and deploying DragonForce ransomware

Vector: Unauthorized access to an unnamed third-party service provider's systems that stored Ericsson employee and customer data

Vector: Ponzi / pyramid scheme

Vector: An unauthorized actor gained access to an unnamed third-party customer service provider used by Adidas, obtaining customer contact data stored in that system

Vector: Attackers exploited an unpatched vulnerability in the Legal Aid Agency's online portal to gain unauthorized access to its database

Vector: Threat actor compromised Spectos GmbH, a German data analytics and service monitoring firm used by Royal Mail to track delivery performance metrics, gaining access to Royal Mail customer and operational data stored on Spectos systems

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Unauthorized network access; attackers had persistent access to Anne Arundel Dermatology systems from February 14 to May 13, 2025

Vector: Smart contract exploit / hack

Vector: On-chain theft (attributed by zachxbt)

Vector: Smart contract exploit / hack

Vector: Authorised but controversial access granted to DOGE operatives to federal systems including OPM, Treasury payment systems (handling $6T in payments), USAJOBS, and other agencies

Vector: Regulatory / legal action

Vector: Ponzi / pyramid scheme

Vector: Phishing attack

Vector: Threat actors bribed and recruited rogue agents working at TaskUs, Coinbase's outsourced customer support contractor in India, to steal customer data from Coinbase's internal support tools

Vector: CWE-308: Use of Single-factor Authentication (compromised employee password, no MFA on PowerSource portal)

Vector: Ponzi / pyramid scheme

Vector: CWE-284: Improper Access Control

Vector: Smart contract exploit / hack

Vector: Clop ransomware group exploited zero-day vulnerabilities in Cleo Harmony, VLTrader, and LexiCom managed file transfer software (CVE-2024-50623, CVE-2024-55956) to access Hertz's file transfer infrastructure

Vector: Smart contract exploit / hack

Vector: Unauthorized party accessed a single individual employee account and associated computer within Lockton's network, then accessed files containing protected health and personal information

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Unauthorized network access; specific method not publicly disclosed

Vector: On-chain theft (attributed by zachxbt)

Vector: Threat actor used compromised credentials to access Finastra's Secure File Transfer Platform (IBM Aspera SFTP); no malware deployed — data-only theft via stolen credentials

Vector: CWE-522: Insufficiently Protected Credentials (infostealer malware infected a third-party retail analytics provider, Robling, leaking credentials used to access Hot Topic's systems)

Vector: Threat actors compromised Stiiizy's third-party point-of-sale (POS) system provider, gaining access to customer purchasing records that include highly sensitive government-issued identity documents

Vector: Attacker exploited an unpatched GitLab vulnerability to gain access to a Byte Federal server hosting customer data

Vector: Smart contract exploit / hack

Vector: Attackers gained access to Free's network via insufficiently protected VPN authentication, then connected to Free Mobile's subscriber management tool (MOBO) to exfiltrate customer records starting October 6, 2024

Vector: CWE-312: Cleartext Storage of Sensitive Information (authentication database exfiltrated; separately DDoS and defacement via JavaScript injection)

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Social engineering / vishing targeting MoneyGram's IT helpdesk; attackers impersonated employees to obtain internal system access

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Ponzi / pyramid scheme

Vector: Smart contract exploit / hack

Vector: Ponzi / pyramid scheme

Vector: Regulatory / legal action

Vector: Attackers created two new fraudulent customer accounts and used them to access other customers' personal information via an internal document management system; no MFA gap on account creation process

Vector: Phishing attack

Vector: Smart contract exploit / hack

Vector: Nation-state attack (Lazarus/DPRK) — private key or social engineering compromise

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: DNS hijacking / domain takeover (front-end compromise)

Vector: DNS hijacking / domain takeover (front-end compromise)

Vector: Ponzi / pyramid scheme

Vector: AI-assisted attack or AI-generated exploit

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Unauthorized access to databases maintained by a small number of independent insurance agency owners affiliated with Globe Life

Vector: On-chain theft (attributed by zachxbt)

Vector: Ponzi / pyramid scheme

Vector: Smart contract exploit / hack

Vector: Regulatory / legal action

Vector: Unauthorized party exploited a vulnerability in a CBIZ web page to access and exfiltrate data from certain databases between June 2-21, 2024

Vector: Threat actor used stolen credentials of a former Tile/Life360 employee to access the customer support platform; inactive credentials not revoked after employee departure

Vector: CWE-284: Improper Access Control (unauthenticated/weakly authenticated partner portal API allowing automated enumeration of service tags)

Vector: Ponzi / pyramid scheme

Vector: CWE-312: Cleartext Storage of Sensitive Information (plaintext admin credentials in publicly accessible Members.zip on sister site RecordsCheck.net)

Vector: Social engineering attack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Phishing attack

Vector: CWE-522: Insufficiently Protected Credentials (compromised third-party vendor user accounts)

Vector: Threat actor IntelBroker exploited a vulnerability in Acuity's Tekton CI/CD server to steal GitHub credentials, then accessed government-related repositories

Vector: Smart contract exploit / hack

Vector: Unauthorized party gained access to VeriSource Services systems on approximately 27 February 2024 and exfiltrated employee benefits data; initial vector not publicly disclosed

Vector: Malicious code injection / supply chain

Vector: Smart contract exploit / hack

Vector: unknown

Vector: Phishing attack

Vector: CWE-284: Improper Access Control

Vector: Third-party vendor breach: Financial Business and Consumer Solutions (FBCS), a debt collection agency handling Comcast customer accounts, was compromised in a ransomware attack February 14–26, 2024

Vector: Unauthorized third party gained access to DISA Global Solutions systems between 9 February and 22 April 2024; initial access vector not publicly disclosed

Vector: unknown

Vector: Attackers gained unauthorized access to NTT Communications' order information system (Order Information Change System) through an undisclosed vulnerability, enabling data exfiltration of corporate customer contract records

Vector: Phishing attack

Vector: Regulatory / legal action

Vector: Smart contract exploit / hack

Vector: Phishing attack

Vector: Undisclosed sophisticated attack on AnyDesk's production systems; AnyDesk described it as a cyberattack on their production systems that resulted in compromise of their private code signing keys and source code; no ransomware was deployed

Vector: Regulatory / legal action

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor (unauthenticated REST API endpoint allowed email-to-profile lookups)

Vector: Exit scam / rug pull

Vector: Smart contract exploit / hack

Vector: On-chain theft (attributed by zachxbt)

Vector: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor (third-party analytics/advertising tracking pixels embedded in patient-facing portal shared PHI with Google, Microsoft Bing, and X/Twitter)

Vector: Insider threat: former developers based in the Philippines claimed to have exfiltrated data in response to unpaid wages (18 months of non-payment)

Vector: Phishing attack

Vector: Withdrawal halt / insolvency

Vector: Smart contract exploit / hack

Vector: Unknown cyber criminal group accessed St Vincent's Health Australia's network by exploiting vulnerabilities in their systems; specific attack vector not publicly disclosed; attacker was able to exfiltrate data before detection

Vector: Regulatory / legal action

Vector: Ponzi / pyramid scheme

Vector: Smart contract exploit / hack

Vector: On-chain theft (attributed by zachxbt)

Vector: Address poisoning attack

Vector: Insider threat: a former Nuance Communications IT employee (Andre J. Burk / 'Max Vance') accessed Geisinger patient records two days after being terminated from Nuance, using credentials that had not yet been deprovisioned

Vector: Smart contract exploit / hack

Vector: On-chain theft (attributed by zachxbt)

Vector: On-chain theft (attributed by zachxbt)

Vector: On-chain theft (attributed by zachxbt)

Vector: Smart contract exploit / hack

Vector: Unauthorized access to Truist Bank systems in October 2023; initial access vector not publicly confirmed; breach was 'immediately contained' per Truist

Vector: Unauthorized access to Marina Bay Sands' Sands LifeStyle loyalty programme customer database; attacker obtained credentials to access the loyalty programme's backend systems

Vector: Smart contract exploit / hack

Vector: Exploitation of Citrix Bleed (CVE-2023-4966) — a critical vulnerability in Citrix NetScaler ADC/Gateway enabling session token hijacking without authentication; Citrix released a patch on October 10, 2023, but attackers breached Xfinity's systems October 16–19 before the patch was applied

Vector: Phishing attack

Vector: Exit scam / rug pull

Vector: Unknown intrusion in October 2023; data later posted for sale on dark web forums in June 2024

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Phishing attack

Vector: Smart contract exploit / hack

Vector: Nation-state attack (Lazarus/DPRK) — private key or social engineering compromise

Vector: Social engineering attack

Vector: Phishing attack

Vector: Regulatory / legal action

Vector: Smart contract exploit / hack

Vector: Unauthorized access to payment gateway systems; attackers maintained persistent access from August 2023 through June 2024 before exfiltrating credit card data in a final two-day window

Vector: Smart contract exploit / hack

Vector: Software bug / unintentional loss

Vector: Exit scam / rug pull

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: On-chain theft (attributed by zachxbt)

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Data was stolen from an external storage location used by HCA Healthcare for email formatting — a tool used to format automated emails to patients; the external storage location was accessed without authorization

Vector: Smart contract exploit / hack

Vector: Unknown attacker exfiltrated a database containing customer records from Dymocks Booksellers; Troy Hunt of Have I Been Pwned was alerted to the breach by a third party who shared the data with him before Dymocks was aware

Vector: Smart contract exploit / hack

Vector: Ponzi / pyramid scheme

Vector: Withdrawal halt / insolvency

Vector: Nation-state attack (Lazarus/DPRK) — private key or social engineering compromise

Vector: Withdrawal halt / insolvency

Vector: On-chain theft (attributed by zachxbt)

Vector: CWE-506: Embedded Malicious Code (Akira ransomware targeting Stanford's Department of Public Safety network)

Vector: Credential stuffing using username/password pairs stolen from prior unrelated breaches

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Unknown network intrusion; suspicious activity identified April 23, 2023; investigators confirmed unauthorized access April 18–23, 2023

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Unknown network intrusion at NCB Management Services, a debt buyer and collection agency

Vector: ALPHV/BlackCat ransomware group gained access to HWL Ebsworth's network; the group subsequently published 1.1 terabytes of stolen data on its dark web leak site after HWL Ebsworth refused to pay a ransom; the initial access vector was not publicly disclosed

Vector: CWE-284: Improper Access Control

Vector: AI-assisted attack or AI-generated exploit

Vector: CWE-522: Insufficiently Protected Credentials (stolen employee login credentials used to access third-party service providers)

Vector: Smart contract exploit / hack

Vector: Smart contract vulnerability exploit

Vector: Ransomware group (IntelBroker, via BreachForums) exploited a vulnerability in the DC Health Benefit Exchange Authority's (DC HBX) health insurance enrollment system to access and exfiltrate personal data for approximately 56,000 individuals including US lawmakers, their families, and congressional staff

Vector: On-chain theft (attributed by zachxbt)

Vector: Unknown ransomware/extortion group gained access to Ferrari's IT systems and exfiltrated customer data; Ferrari stated it received a ransom demand from the attackers but chose not to pay; Ferrari did not disclose the specific technical attack vector

Vector: CWE-284: Improper Access Control

Vector: Smart contract exploit / hack

Vector: Insider data exfiltration — a Consumer Financial Protection Bureau (CFPB) employee used their authorized access to CFPB systems to send 14 emails containing sensitive consumer data to their personal email account without authorization

Vector: CWE-1021: Improper Restriction of Rendered UI (targeted spear-phishing with real-time TOTP relay against single employee)

Vector: Attacker gained unauthorized access to Western Sydney University's Microsoft 365 email environment and SharePoint files via compromised credentials; maintained persistent access over several months exfiltrating data; a separate subsequent breach in 2024 affected the Student Management System

Vector: Smart contract exploit / hack

Vector: CWE-284: Improper Access Control

Vector: Smart contract exploit / hack

Vector: On-chain theft (attributed by zachxbt)

Vector: Smart contract exploit / hack

Vector: Unauthorized access to a third-party contractor's environment; 240 GB of Toyota internal data surfaced on a hacking forum in August 2024, believed stolen as far back as December 2022

Vector: Smart contract exploit / hack

Vector: Attacker sent an SMS phishing (smishing) message to an Activision HR employee impersonating the company's IT department; the employee provided their MFA code, giving the attacker access to Activision's internal HR and communications systems

Vector: CWE-306: Missing Authentication for Critical Function (unauthenticated API endpoint exposing customer data)

Vector: Smart contract exploit / hack

Vector: Seed phrase / wallet compromise

Vector: Oracle price manipulation

Vector: Smart contract vulnerability exploit

Vector: Smart contract exploit / hack

Vector: CWE-307: Improper Restriction of Excessive Authentication Attempts (credential-based unauthorised access to a hosted Microsoft Exchange service)

Vector: Software bug / unintentional loss

Vector: MEV / sandwich attack

Vector: Smart contract exploit / hack

Vector: CWE-306: Missing Authentication for Critical Function (internet-exposed API with no authentication due to 2018 coding error not remediated on sub-domain)

Vector: Scattered Spider attacker (same individual as the 2022 Uber breach) gained access to Rockstar Games' Slack workspace using compromised employee credentials; from Slack, the attacker accessed Confluence wikis and was able to download internal development materials and GTA 6 footage

Vector: On-chain theft (attributed by zachxbt)

Vector: Unauthorized access to a Plex database; attacker used unknown means to access the Plex database containing user account information; the breach was disclosed the day after discovery

Vector: Smart contract exploit / hack

Vector: DNS hijacking / domain takeover (front-end compromise)

Vector: Software bug / unintentional loss

Vector: Withdrawal halt / insolvency

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Seed phrase / wallet compromise

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Flash loan attack on smart contract

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Flash loan attack on smart contract

Vector: Smart contract exploit / hack

Vector: CWE-522: Insufficiently Protected Credentials (exact vector not disclosed; Lapsus$ used credential theft and social engineering techniques)

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Lapsus$ gained initial access through a VPN session hijack using credentials stolen via an infostealer (reportedly from an Nvidia employee's personal device); the group gained access to Nvidia's internal development environment and exfiltrated approximately 1 terabyte of data

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Ransomware attackers compromised Medlab Pathology (subsidiary of Australian Clinical Labs) via an unpatched internet-facing system, exfiltrating patient pathology records before deploying ransomware

Vector: Smart contract exploit / hack

Vector: Sophisticated nation-state-level attacker (ICRC later assessed the attack as deliberate, targeted, and state-sponsored) exploited an unpatched critical authentication bypass vulnerability (CVE-2021-40539) in Zoho ManageEngine ADSelfService Plus deployed by a third-party contractor; attacker deployed webshells and custom malware BEACON and GLASSTOKEN

Vector: Smart contract exploit / hack

Vector: Exit scam / rug pull

Vector: Oracle price manipulation

Vector: Software bug / unintentional loss

Vector: Unauthenticated API endpoint introduced in a June 2021 code change allowed any caller to submit phone numbers or email addresses and receive the associated Twitter account ID — enabling mass enumeration of accounts linked to private contact information

Vector: Automated enumeration and scraping of WhatsApp's user phone number registration/lookup mechanism to compile a database of active WhatsApp user phone numbers across 84 countries

Vector: Exit scam / rug pull

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: A former Cash App employee who retained access to internal reports after leaving the company downloaded customer brokerage account data without authorization; the employee downloaded reports after their employment terminated

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Malicious code injection / supply chain

Vector: A vulnerability in Twitter's API allowed anyone with a phone number or email address to query and retrieve the associated Twitter account, effectively enabling the enumeration of Twitter accounts and the collection of public profile data linked to private contact information; the vulnerability was reported via HackerOne bug bounty in January 2022

Vector: Smart contract exploit / hack

Vector: Oracle price manipulation

Vector: Smart contract exploit / hack

Vector: Flash loan attack on smart contract

Vector: Social engineering — an attacker impersonated a Cox Communications support representative to gain access to internal Cox systems and then accessed customer account information

Vector: A file containing Ambulance Victoria staff personal data was inadvertently uploaded to a publicly accessible part of Ambulance Victoria's website, where it was accessible without authentication

Vector: An unauthorized third party used a compromised password to gain access to GoDaddy's Managed WordPress hosting environment's provisioning system in their legacy codebase

Vector: Software bug / unintentional loss

Vector: Flash loan attack on smart contract

Vector: Smart contract exploit / hack

Vector: Phishing emails compromised employee email accounts at Apria Healthcare; the company experienced two separate unauthorized access periods (May-August 2019 and August-October 2021); the 2019 intrusion was discovered during investigation of the 2021 compromise

Vector: Smart contract exploit / hack

Vector: Flash loan attack on smart contract

Vector: Attacker John Binns (21-year-old US-born, living in Turkey) brute-forced his way through T-Mobile's unprotected GPRS tunneling protocol (GTP) routers exposed on the internet, gained access to a testing environment, then used that foothold to reach and download T-Mobile's IMSI database and customer data

Vector: CWE-284: Improper Access Control

Vector: Attackers purchased stolen Slack authentication cookies from an underground criminal marketplace for $10 and used them to impersonate an EA employee in Slack; used Slack access to social engineer EA's IT support into issuing a multi-factor authentication token, granting VPN and corporate network access

Vector: A vulnerability in Latitude Financial's data systems allowed unauthorized access to a subset of customer personal information; this earlier incident preceded the much larger March 2023 breach in which 14 million customer records were stolen via a compromised managed service provider credential

Vector: CWE-284: Improper Access Control (unauthenticated API endpoint allowed email-to-account enumeration)

Vector: Flash loan attack on smart contract

Vector: Software bug / unintentional loss

Vector: Systematic API scraping and data aggregation from LinkedIn's public profile data and APIs; attacker 'GOD User TomLiner' combined LinkedIn API data with other publicly available sources

Vector: Smart contract exploit / hack

Vector: Smart contract exploit / hack

Vector: Misconfigured internal mapping website — IDHS planning maps intended for internal use were inadvertently made accessible via the public internet; no malicious actor involved

Vector: Misconfigured Google Analytics integration on Blue Shield member websites inadvertently shared protected health information with Google Ads for advertising targeting purposes

Vector: Unknown attacker gained unauthorized access to a Luxottica partner application used for managing eye care appointments; the application stored scheduling and patient data for EyeMed Vision Care and Lenscrafters patients

Vector: Software bug / unintentional loss

Vector: Smart contract exploit / hack

Vector: Software bug / unintentional loss

Vector: API scraping via enumerable insecure direct object references (IDOR) — Parler's API endpoints used sequential integer IDs with no authentication required; after Amazon Web Services announced it would terminate Parler's hosting (in response to its role in organizing the January 6 Capitol attack), researchers and archivists systematically scraped the entire public-facing API before the site went offline

Vector: Unknown attacker gained persistent access to Neopets' databases; the attacker allegedly had access for approximately 18 months before the breach was publicly discovered; the attacker offered both the stolen data and continued live read/write access to Neopets' databases for sale

Vector: Broken object-level authorization (BOLA/IDOR) — Peloton's API allowed unauthenticated access to any user's profile data by supplying a target user ID; private accounts that users had specifically set to 'private' in the app returned full profile data to unauthenticated API requests

Vector: Unknown attacker gained unauthorized access to Nitro PDF's user database and document storage; Nitro PDF is a document productivity service used by major enterprises for PDF editing and e-signatures

Vector: Systematic API/web scraping of Gravatar's public-facing user profile API endpoint; Gravatar's service is designed to return publicly accessible profile information (username, display name, avatar, location, biographical info) for any user by querying their MD5-hashed email address — attackers enumerated MD5 hashes of email addresses to harvest profiles at scale, then cracked the weak MD5 email hashes to obtain the original email addresses

Vector: An attacker used an SQL injection vulnerability in Freepik's website to access the Freepik and Flaticon user databases; the SQL injection gave the attacker access to the database tables containing user credentials and personal information

Vector: Database breach via unknown vulnerability in Wattpad's backend infrastructure; approximately 268 million records were obtained from the platform's user database and subsequently offered for sale on hacker forums

Vector: A fraudster posing as a legitimate client of Experian South Africa used social engineering to convince Experian to provide a dataset containing personal information; the attacker presented fraudulent credentials and business information to obtain the data transfer

Vector: Phishing — employees of Norwegian Cruise Line Holdings were targeted with phishing emails that resulted in unauthorized access to employee email accounts; attackers then accessed personal data of employees, travel agents, and some customers stored in those accounts

Vector: Unknown attacker gained unauthorised access to Clearview AI's systems and exfiltrated the company's entire client list — including law enforcement agencies, government clients, and private entities — along with their search histories (faces searched)

Vector: Sophisticated cyber attack; specific technical vector not publicly disclosed; EasyJet stated it was a highly sophisticated attacker; email addresses and travel details were the primary target alongside payment card data for a subset of customers

Vector: Sophisticated cyberattack against easyJet's systems; the specific technical attack vector was not publicly disclosed by the airline, but the UK's National Cyber Security Centre (NCSC) and ICO investigated

Vector: Application vulnerability in online quoting websites that displayed full driver's licence numbers in plain text with minimal user input; scraped by automated attackers

Vector: Unknown attacker gained unauthorized access to T-Mobile's prepaid account information through a misconfigured API or application server; T-Mobile stated it was a criminal attack that gained access to prepaid account subscriber information

Vector: Intentional data sharing via third-party advertising tracking pixels — Cerebral embedded Meta Pixel, Google analytics/advertising, TikTok Pixel, and other trackers on its website and apps that transmitted sensitive mental health patient data to advertising platforms without patients' knowledge or valid HIPAA authorization

Vector: Third-party tracking pixels — Cerebral used Meta Pixel, Google Analytics, TikTok Pixel, and other advertising trackers on its website and app; these trackers automatically captured and transmitted sensitive mental health information, medication details, and personal identifiers to advertising platforms

Vector: Third-party vendor misconfigured an unauthenticated MongoDB database, publicly exposing 5.6 million guest records copied from Choice Hotels' systems for use in testing a security product — without authorization; automated scripts also left a ransom note demanding 0.4 BTC

Vector: Application vulnerability — the 7pay app (7-Eleven Japan's new mobile payment application) had a flawed password reset mechanism that allowed attackers to reset any account's password by supplying only the account holder's email address, date of birth, and phone number; a design flaw also allowed password reset links to be sent to a third-party email address

Vector: A hacker (later identified as a 20-year-old Bulgarian cybersecurity specialist) exploited a SQL injection vulnerability in the Bulgarian National Revenue Agency (NRA) web application to extract taxpayer data from the agency's database

Vector: Third-party website vulnerability — hackers exploited a security flaw in Samsung's 'Add a Line' webpage (a retail portal used to add new Sprint lines), which allowed unauthorized access to Sprint customer account data

Vector: The hacker GnosticiPlayers (responsible for multiple high-profile breaches in 2019) accessed Canva's user database via an unknown vulnerability; the attacker was able to view file names of private design files stored in Google Cloud Storage but could not access their contents

Vector: An unknown hacker gained unauthorized access to StockX's systems and obtained a copy of the user database; the attacker reached out to Vice/Motherboard journalist Lorenzo Franceschi-Bicchierai offering to sell the stolen data, which prompted investigation and disclosure

Vector: The Tim Hortons mobile app collected continuous location data from users even when the app was not in use — far exceeding what was necessary for the app's stated functionality; the covert tracking persisted between app sessions without adequate consent disclosure

Vector: Attackers exploited Facebook's 'Add friend by phone number' contact import feature, which allowed mass enumeration of user accounts by phone number without rate limiting; scraped in 2019, patched by Facebook in August 2019

Vector: CWE-284: Improper Access Control

Vector: CWE-89: SQL Injection (unauthorised access to a central data warehouse via a web application vulnerability)

Vector: An unauthorized third party gained access to Quora's systems via unknown means; Quora stated it discovered the breach on Friday 30 November 2018 and immediately began investigation

Vector: Magecart Group 6 injected a 22-line JavaScript skimmer into British Airways' website and mobile app via a compromised third-party Modernizr JavaScript library; skimmer exfiltrated payment card data to attacker-controlled domain baways.com

Vector: An international hacker (later identified as a 21-year-old in the Netherlands) exploited an API vulnerability in T-Mobile's system to access and extract customer data; the vulnerability allowed access to customer account data without proper authentication

Vector: Web payment portal of American Medical Collection Agency (AMCA), a third-party billing collections vendor, was compromised — attackers skimmed payment card data and personal information from AMCA's web payment system for approximately 8 months

Vector: Advanced persistent threat group (assessed as state-sponsored, linked to Chinese APT10/APT41) used phishing email to compromise a SingHealth front-end workstation, moved laterally to the SCM database via multiple infected machines, and used a custom remote access tool to extract data over approximately three weeks

Vector: Unauthorized access to Flipboard's databases; the attacker accessed and potentially exfiltrated user data on two separate occasions — once between 2 June 2018 and 22 March 2019, and again between 21-22 April 2019; Flipboard detected the second intrusion through monitoring of its systems

Vector: Business email compromise (BEC) phishing attack targeting UnityPoint Health employees; attackers sent emails impersonating a trusted executive, convincing employees to provide their email credentials; the compromised employee email accounts were then accessed by attackers who could view and exfiltrate protected health information from email contents

Vector: An attacker gained access to Cathay Pacific's IT systems containing passenger data; Cathay discovered suspicious activity on its network in March 2018 but did not identify the breach until May 2018; the attack vector was not publicly disclosed in detail

Vector: Unauthorized party acquired data associated with MyFitnessPal user accounts; specific technical attack vector was not disclosed by Under Armour; data was obtained from the MyFitnessPal app and website user database

Vector: HealthEngine shared patient appointment and health data with Slater & Gordon law firm and health insurance funds without adequate patient consent, using fine print in terms of service that patients were unlikely to read; separately, HealthEngine edited negative reviews posted on its platform before publication

Vector: An unauthenticated API endpoint on Panera Bread's website exposed customer records in plaintext — accessible to anyone with a web browser; the vulnerability was reported to Panera by security researcher Dylan Houlihan in August 2017 but Panera took 8 months to fix it

Vector: A hacker group (later identified as Behzad Mesri, an Iranian national) gained access to HBO's internal network via unknown means and exfiltrated approximately 1.5 terabytes of data including scripts, episodes, and internal company documents; the attacker demanded $6 million in Bitcoin ransom

Vector: Vendor mailing error — a third-party mailing vendor used envelopes with an oversized clear window cutout that allowed the letter body text (which referenced HIV medications by name) to be visible through the envelope without opening it, disclosing members' HIV status to anyone who handled the mailing

Vector: An unknown attacker (who later reached out to Zomato directly) gained access to Zomato's database and exfiltrated user records; Zomato's engineering team determined that an internal vulnerability allowed the attacker access; the attacker offered to sell the data and then agreed to delete it after Zomato engaged with them

Vector: CWE-284: Improper Access Control (unauthorised access to Bell systems by an unnamed hacker who threatened to release data unless Bell lobbied against Canadian internet regulation)

Vector: FIN7 cybercriminal group (JokerStash/Carbanak) installed POS RAM-scraping malware on point-of-sale systems across Saks Fifth Avenue and Lord & Taylor stores nationwide; the malware captured payment card track data from device memory during transactions for approximately 10 months

Vector: Unknown attacker gained unauthorized access to Wonga's systems and customer data; Wonga identified the breach through internal monitoring and immediately launched an investigation; the specific attack vector was not disclosed publicly

Vector: Attackers installed point-of-sale (POS) malware on payment systems at the majority of Chipotle restaurant locations; the malware read payment card data from the magnetic stripe track data in RAM (RAM scraping) during the transaction window

Vector: CWE-20: Improper Input Validation / Apache Struts OGNL injection

Vector: Insecure Direct Object Reference (IDOR) in First American's EaglePro web application — any authenticated user with a valid document link could increment a sequential numeric document ID in the URL to access any other document without authorization; vulnerability exploitable by any logged-in user without special privileges

Vector: Multiple vulnerabilities and unauthorized access points were identified in the Aadhaar ecosystem: anonymous database access was sold via WhatsApp groups for ₹500; state government portals and websites operated by utility companies exposed Aadhaar numbers; the Aadhaar eKYC API lacked proper rate limiting and access controls

Vector: Malicious insider — a Desjardins employee who had legitimate access to member data as part of their role — exfiltrated member personal data over approximately 26 months and shared the data with third parties outside the organization

Vector: A malicious insider (a Desjardins employee) collected and exfiltrated personal data of members over a period of approximately 26 months, sharing the data with unauthorized third parties outside the organization

Vector: Intentional data sharing — GoodRx embedded third-party tracking pixels (from Meta/Facebook, Google, Criteo, Branch.io, and Twilio) on its website and apps that transmitted users' sensitive health and prescription information to advertising platforms for targeting and retargeting purposes

Vector: Third-party tracking pixels and SDKs — GoodRx embedded Meta Pixel, Google Analytics, and other advertising trackers on its website and app that automatically transmitted users' health and prescription information to advertising platforms for targeted advertising purposes

Vector: Fraudsters used a legitimate employee login credential (obtained via an insider or social engineering) to access Three Mobile's customer upgrade database; they then used customer data to intercept handset upgrades — diverting new handsets to fraudsters rather than legitimate customers

Vector: A web developer working for the Red Cross Blood Service's website contractor accidentally uploaded a production database backup file (.sql dump) to a publicly accessible directory on the redcrossblood.org.au website; discovered by an independent security researcher who responsibly disclosed it

Vector: A web development contractor (Precedent Communications, later identified) inadvertently uploaded a backup file of donor registration data to a publicly accessible directory on the Australian Red Cross Blood Service website; the file was discovered by a security researcher and reported responsibly

Vector: Database compromise of Dailymotion's user account database; the specific initial access vector was not publicly disclosed

Vector: Local File Inclusion (LFI) vulnerability on FriendFinder Network servers allowed attackers to read arbitrary files, including the password database; passwords stored in plaintext or reversible SHA-1 hashes

Vector: Attacker compromised an administrator account on Deloitte's Microsoft Azure-hosted email platform that had no multi-factor authentication enabled; this granted unrestricted access to the Azure Active Directory storing email for all partners and staff

Vector: Malware installed on LifeBridge Health's server supporting its registration and billing systems and electronic medical records; the malware gained unauthorized access to a server connected to systems containing patient data — the precise initial intrusion vector was not disclosed; the breach was discovered more than a year after it began

Vector: The Dark Overlord gained access to multiple healthcare clinics and providers by exploiting Remote Desktop Protocol (RDP) vulnerabilities — specifically brute-forcing RDP credentials or exploiting unpatched RDP vulnerabilities on internet-facing systems; stolen data was then used for extortion of both the healthcare providers and directly of patients

Vector: Attackers first compromised Banner Health's food and beverage payment card systems (targeting point-of-sale systems at Banner's healthcare facility cafeterias and restaurants) and used that initial foothold to pivot into Banner's main healthcare network, accessing patient data systems

Vector: Attackers first compromised Banner Health's food and beverage payment processing systems (POS attack at hospital dining locations) on June 17, 2016, then used that foothold to pivot laterally into Banner's healthcare IT network to access patient, member, and provider databases

Vector: Unauthorized access to a production server at Newkirk Products containing health plan member data; attacker gained access to the server hosting membership data; the server was shut down upon discovery on July 6, 2016

Vector: Hacktivist group 'LulzSec Pilipinas' defaced the Commission on Elections (COMELEC) website and dumped the entire voter database; a second group called 'Anonymous Philippines' also separately published the database; the initial defacement was carried out by exploiting a vulnerability in the COMELEC website

Vector: Unknown attacker gained unauthorized access to Weebly's user database and exfiltrated account credentials and associated data for approximately 43 million users; the breach data was acquired by data breach researcher Troy Hunt and added to Have I Been Pwned

Vector: Physical loss — six unencrypted hard drives containing health plan member data were misplaced and could not be located during an IT data project; the drives were being used to store laboratory test result data for a health outcomes improvement initiative

Vector: Unknown attacker gained access to the Lifeboat Minecraft server network database; Lifeboat is a popular Minecraft Pocket Edition server network with millions of registered child and teen players; the attacker accessed email addresses and weakly hashed (MD5) passwords

Vector: Unknown attackers exploited a vulnerability in a Verizon Enterprise Solutions web portal and exfiltrated customer business data; the data was subsequently offered for sale in a Russian cybercriminal forum for $100,000 or $10,000 per portion

Vector: A hacker accessed VTech's Learning Lodge app store (used by parents to download apps for VTech children's devices) and the Kid Connect messaging app database via SQL injection vulnerability in the website; attacker extracted customer and children's databases

Vector: Three teenagers exploited a SQL injection vulnerability in a legacy web component of TalkTalk's website (an outdated Metapack database acquired in 2009 that was inadequately secured); the attackers scraped customer data from the vulnerable endpoint

Vector: FBI notified 21st Century Oncology that its systems had been compromised by an unknown attacker who gained access to its patient database; specific technical attack vector was not disclosed; the FBI discovered the breach during an unrelated investigation and tipped off the cancer treatment provider

Vector: External attacker gained unauthorized access to 21st Century Oncology's patient database; on November 13, 2015 the FBI notified the company that a hacker had illegally obtained data from their systems; exact initial access vector not publicly disclosed

Vector: Impact Team claimed to have insider access to Avid Life Media's (ALM) systems; exfiltrated user account database, company email, source code, and payment records; threatened to publish unless the site was shut down

Vector: An unknown attacker (later claimed to be Phineas Fisher, a hacktivist) penetrated Hacking Team's internal network by first attacking an embedded system (a router), pivoting to internal systems, and ultimately obtaining access to Hacking Team's source code repositories, email archives, and internal documents; tools and zero-day exploits were also stolen

Vector: POS malware — attackers installed RAM-scraping malware on Sally Beauty point-of-sale systems to capture payment card track data at checkout; similar attack methodology to the retailer's first breach in 2014

Vector: Attackers used stolen personally identifiable information (SSNs, dates of birth, tax filing status, and street addresses — likely from prior third-party breaches) to pass the IRS 'Get Transcript' online application's knowledge-based authentication questions and access prior-year tax transcripts

Vector: China-linked threat actor (Indrik Spider / Deep Panda) used a spear-phishing email targeting an Anthem subsidiary to establish initial access, then moved laterally to Anthem's enterprise data warehouse containing unencrypted member records

Vector: Insider threat — a Morgan Stanley financial advisor (Galen Marsh) with authorized access to client data used his legitimate credentials to download and exfiltrate approximately 350,000 client records from internal systems over the course of several months

Vector: Russian state-sponsored hackers (attributed to APT29 / Cozy Bear) gained access to the U.S. State Department's unclassified email network; initial access likely via spear-phishing followed by lateral movement and persistent backdoor implants

Vector: A sophisticated cyberattacker (assessed as China-linked APT, consistent with the wave of health insurer breaches in 2014-2015) gained access to UCLA Health's network and accessed parts of the network containing personal and medical information for approximately 4.5 million individuals

Vector: Nation-state attackers (believed to be Chinese APT) gained access to UCLA Health's network and moved laterally to unencrypted parts of the network containing patient data; initial vector not publicly confirmed

Vector: CWE-89: SQL Injection (hacker group NullCrew exploited SQL injection in Bell's systems)

Vector: Unknown attacker gained unauthorized access to K Box's membership database through a vulnerability in their website; the database was not adequately protected and allowed access to member personal information

Vector: APT10 (Chinese state-sponsored) used stolen credentials from a KeyPoint Government Solutions contractor to access OPM's network, then pivoted to the SF-86 security clearance database via a legacy Oracle database with no multi-factor authentication

Vector: SQL injection or web application attack against Domino's Pizza's online ordering system in Belgium and France; hacker group Rex Mundi claimed responsibility and threatened to publish the data unless a ransom of €30,000 was paid

Vector: China-linked nation-state APT (same group attributed to Anthem and Premera breaches) gained access to CareFirst's network approximately eleven months before detection; initial access vector was consistent with spear-phishing used in contemporaneous health insurer breaches

Vector: A group called Rex Mundi gained access to Domino's Pizza France and Belgium's online ordering systems and databases through a vulnerability in the web application; the group claimed to have exploited SQL injection or similar techniques to access customer order databases

Vector: Russian criminal group (linked to Bitcoin exchange operators) exploited an unpatched vulnerability on a JPMorgan Chase server — specifically a zero-day in the bank's website that was not updated to use two-factor authentication; attackers gained root privileges on more than 90 servers

Vector: Attackers exploited a missed security upgrade on a single JPMorgan server — a bank employee had forgotten to enable two-factor authentication on one web application server — allowing the attackers to obtain a root-level list of applications and servers, then pivot to over 90 bank servers

Vector: Chinese APT intrusion (same infrastructure as Anthem and Premera breaches); attackers first compromised CareFirst's network in April 2014, but that incursion was identified and contained; attackers re-entered via backdoors in June 2014 and maintained access until April 2015 when Mandiant detected the intrusion

Vector: Nation-state APT group (assessed as Winnti/APT41, China-linked) gained initial access via a spear-phishing email; maintained persistent access for approximately 9 months while conducting lateral movement and data exfiltration from Premera's member database

Vector: Nation-state attackers (believed to be Chinese APT, same campaign as Anthem breach) gained initial access via spear-phishing email with malicious attachment; established persistent access to Premera's IT environment for approximately 9 months before detection

Vector: Advanced persistent threat group (Mandiant/FireEye attributed to China, assessed as APT18/Wekby) used spear-phishing to gain initial access and deployed a customized version of the Mimikatz credential-harvesting tool; attacker moved laterally across CHS's 200+ hospital network

Vector: Cybercriminals installed POS RAM-scraping malware on point-of-sale systems at Staples office supply stores; the malware captured payment card track data from device memory during transaction processing

Vector: APT18 (Dynamite Panda), a Chinese state-linked threat actor, exploited the Heartbleed vulnerability (CVE-2014-0160) against Community Health Systems' Juniper VPN appliance to extract VPN credentials from memory; used stolen credentials to authenticate as a legitimate user and access the network

Vector: Attackers used stolen vendor credentials (from a third-party vendor) to access Home Depot's network, then exploited an unpatched Windows vulnerability to move laterally and deploy a custom variant of BlackPOS RAM-scraping malware on self-checkout POS systems

Vector: POS malware — attackers installed RAM-scraping malware on point-of-sale systems at Staples retail stores, capturing payment card track data at the time of purchase

Vector: Chinese state-sponsored attackers (APT3/Gothic Panda, potentially distinct from the APT10 intrusion responsible for the SF-86 clearance breach) gained access to OPM's personnel records system; the initial vector involved stolen credentials, with attackers using the PlugX RAT for persistence

Vector: Attackers gained unauthorized access to a University of Maryland database server containing records for all faculty, staff, and students who had been issued a university ID; the specific technical attack vector was not fully disclosed but involved unauthorized access to a records database

Vector: SQL injection attack against Kickstarter's database; law enforcement notified Kickstarter of the unauthorized access on February 12, 2014

Vector: Unauthorized access to an FAA internal computer system containing employee records; the agency reported the system was accessed without authorization, though the specific technical vector was not fully disclosed publicly

Vector: Attackers compromised the login credentials of a small number of eBay employees with database access, then used those credentials to access eBay's corporate network and exfiltrate the customer database

Vector: A disgruntled Morrisons senior internal IT auditor (Andrew Skelton) with legitimate access to payroll data deliberately copied and leaked the personal and financial data of 99,998 Morrisons employees to newspaper outlets and multiple file sharing websites, motivated by a personal grievance over a disciplinary matter

Vector: Data exposure — files containing student and former student personally identifiable information including Social Security numbers were left accessible on a publicly reachable server without proper access controls; discovered during a routine security audit

Vector: Chinese state-sponsored hackers gained persistent access to USPS corporate networks; the exact initial vector was not fully disclosed publicly but likely involved spear-phishing or exploitation of an internet-facing system followed by lateral movement

Vector: CWE-506: Embedded Malicious Code / Remote Access Trojan deployed in Starwood network prior to Marriott acquisition

Vector: Nation-state APT group (assessed as same Chinese threat actor responsible for Anthem and Premera breaches) gained initial access in December 2013 via unknown means and maintained persistent access for approximately 20 months before being discovered during a forensic investigation

Vector: Sophisticated APT intrusion (consistent with Chinese state-linked APT campaign that also targeted Anthem, Premera Blue Cross, and CareFirst BCBS in the same period); attackers maintained undetected access for approximately 20 months; Excellus engaged Mandiant after sister organizations were breached, which revealed the compromise

Vector: An attacker gained access to Cupid Media's database — an Australian company operating approximately 35 niche online dating websites; the stolen database surfaced in a cache of databases found on a server used by cybercriminals that had been seized by investigators

Vector: Insider threat — employees at AT&T's outsourced call centers in Colombia, Mexico, and the Philippines improperly accessed and sold customer data (names and partial/full Social Security numbers) to unauthorized third parties to facilitate unauthorized phone unlocking for profit

Vector: Sophisticated targeted attack — attackers breached Scottrade's network via methods consistent with the same criminal group responsible for the JPMorgan Chase 2014 breach; the investigation found unauthorized access to a database containing customer contact information

Vector: Attackers gained access to Adobe's network and exfiltrated source code for Acrobat, ColdFusion, and Reader; also accessed the customer database containing passwords encrypted with 3DES using the same key for all accounts

Vector: POS malware — attackers installed malware on Neiman Marcus point-of-sale terminals that scraped payment card track data (including magnetic stripe data) from memory as cards were swiped at checkout

Vector: Physical theft of four unencrypted desktop computers from Advocate Medical Group's administrative offices in Park Ridge, Illinois; two subsequent smaller incidents involved theft of an unencrypted laptop from an employee's car and a business associate (Blackhawk Consulting Group) compromise

Vector: Four unencrypted laptops were stolen from an Advocate Medical Group administrative office in Park Ridge, Illinois; the laptops contained patient data for approximately 4 million patients and were not encrypted despite Advocate's data security policies

Vector: Two separate breaches: (1) 2013 — attackers forged authentication cookies using stolen Yahoo proprietary cookie-minting code, bypassing password requirements entirely; (2) 2014 — Russian state-sponsored actors (FSB/Karim Baratov/Alexsey Belan) used spear-phishing to steal Yahoo admin credentials and copied the User Account Database backup

Vector: Aleksandr Kogan's app 'This Is Your Digital Life' exploited Facebook's Open Graph API permission model, which allowed apps to harvest not only the personal data of users who installed the app but also all of their friends' data — without those friends' consent or knowledge

Vector: Sophisticated POS RAM-scraping malware was installed on point-of-sale terminals at Michaels arts-and-crafts retail stores and its subsidiary Aaron Brothers; the malware was specifically engineered to evade Michaels' security tools and captured payment card track data from memory during transactions

Vector: Database compromise; the breach occurred in early 2013 but was not disclosed until the dataset appeared for sale on dark web markets in May 2016 — Tumblr was notified by threat intelligence company Mapbox subsidiary Haveibeenpwned/Troy Hunt; the original attack vector was not publicly identified due to the three-year delay

Vector: Unknown attacker gained unauthorized access to LivingSocial's customer database; specific technical attack vector was not disclosed; attacker accessed and exfiltrated up to 50 million customer records

Vector: Unauthorized access to LivingSocial's database systems; the specific technical vector was not disclosed publicly, but the attacker gained read access to a customer database

Vector: Unknown attacker gained access to Evernote's user database; Evernote described the attack as targeting their network infrastructure; attacker accessed usernames, email addresses, and encrypted passwords

Vector: Database compromise of Imgur's user account database; the breach occurred in 2013 but was not discovered until security researcher Troy Hunt shared a file containing Imgur credentials with the company in November 2017; the precise initial attack vector was not identified due to the years-long delay

Vector: Physical theft — an unencrypted laptop computer containing patient data was stolen from Howard University Hospital

Vector: Two separate nation-state APT intrusions: one attributed to China-based actors (active from approximately September 2012) and one from an unattributed threat actor; the attackers used sophisticated malware to gain persistent access to Penn State's College of Engineering network

Vector: CWE-78: Improper Neutralisation of Special Elements (spear-phishing email delivered malware, leading to credential theft and access to tax database)

Vector: An unauthorized party illegally accessed Battle.net's internal network and obtained information from Blizzard's user database; the specific intrusion vector was not disclosed; the attacker gained access to database servers in the Americas region

Vector: Unknown attacker gained access to a snapshot of Disqus's user database dating from July 2012; the specific intrusion mechanism was not disclosed; the breach data sat dormant for over five years before being shared with security researcher Troy Hunt who alerted Disqus

Vector: Database compromise; the breach occurred in July 2012 but was not discovered until security researcher Troy Hunt provided Disqus with a copy of the dataset in October 2017 — five years after the breach

Vector: Insider threat — a former employee of South Carolina's Department of Health and Human Services (DHHS) accessed the Medicaid eligibility database and transferred files containing beneficiary data to an unauthorized location; the employee later posted the data online

Vector: SQL injection or server compromise allowed attackers to exfiltrate LinkedIn's password database containing unsalted SHA-1 password hashes; in 2016, the full scope (117M records) was revealed when the data appeared for sale

Vector: Attackers breached a Zappos database server located in Kentucky; the specific initial attack vector was not fully disclosed by the company, but the attacker accessed the internal network and the customer database

Vector: Internal system design failure: Facebook's password logging infrastructure incorrectly logged user passwords in plaintext to internal log files; these log files were stored in searchable plaintext accessible by thousands of Facebook engineers; this was a systemic implementation error rather than an external attack

Vector: Attackers used an undisclosed method to breach Global Payments' systems and exfiltrate track 1 and track 2 magnetic stripe card data (full card data for card cloning) for approximately 1.5 million card accounts

Vector: Physical theft — an unencrypted desktop computer was stolen from a Sutter Medical Foundation administrative office in Sacramento, California; the computer contained a Microsoft Access database with patient information

Vector: Physical theft — an unencrypted desktop computer was stolen from a Sutter Physicians Services administrative office in Sacramento, California; the computer contained an unencrypted database file with patient information

Vector: Physical theft — backup tapes containing TRICARE beneficiary data were stolen from an employee's car in San Antonio, Texas; the tapes were being transported between SAIC facilities by a contractor employee

Vector: Physical theft — backup tapes were stolen from a Science Applications International Corporation (SAIC) employee's vehicle in San Antonio, Texas while the employee was transporting them; the tapes were unencrypted

Vector: Attackers exploited a known vulnerability in Apache HTTP Server running on Sony's PlayStation Network infrastructure, gaining access to the PSN and Sony Online Entertainment (SOE) databases

Vector: Direct web application attack — hackers exploited an insecure direct object reference (IDOR) vulnerability in Citi's online banking portal by manipulating account numbers embedded in the site URL, allowing them to access other customers' account pages without authorization

Vector: Spear-phishing attack against Epsilon employees by Vietnamese cybercriminals; targeted phishing campaigns installed malware enabling access to Epsilon's customer email databases; attackers were part of a broader operation targeting multiple email marketing firms

Vector: Network misconfiguration — a physician employed by Columbia University attempted to deactivate a personal computer server on the shared network; instead the misconfiguration exposed an application database, making patient records accessible on the internet

Vector: A Columbia University physician decommissioned a personal server that was connected to the shared Columbia/NYP network without following proper procedures; the server lacked server-level firewall protections, resulting in approximately 6,800 patient records becoming accessible on the internet

Vector: SQL injection exploit against RockYou's web application allowed attacker to dump the entire user database, which stored 32 million passwords in plaintext with no hashing

Vector: Network intrusion targeting RBS WorldPay's payment processing platform; attackers gained access to the card processing environment and stole encrypted payment card data along with the encryption keys, enabling them to decode and clone magnetic stripe data for prepaid payroll cards

Vector: Three separate network intrusions exploiting Wyndham's systemic security failures: unencrypted storage of payment card data, easily guessable passwords, failure to patch known vulnerabilities, failure to use firewalls, and failure to restrict third-party vendor access to the corporate network — attackers exfiltrated data to a domain registered in Russia

Vector: Unknown server compromise; passwords stored as unsalted SHA-1 hashes of only the first 10 lowercase characters of each password — trivially crackable with rainbow tables

Vector: Attackers installed malware on Hannaford's point-of-sale servers that intercepted and transmitted unencrypted card data in real time as transactions were authorized, despite Hannaford being fully PCI-DSS compliant at the time

Vector: Albert Gonzalez (TJX hacker) and accomplices used SQL injection to gain access to Heartland's payment processing network, planted a network packet sniffer in the internal payment processing system to capture card data in transit

Vector: AOL's Research department intentionally released 20 million anonymized search queries from 650,000 users to the public for academic research; the 'anonymization' was trivially reversible — reporters and researchers re-identified named individuals from their search patterns within days

Vector: A VA data analyst took home a VA-issued laptop and external hard drive containing 26.5 million veterans' PII without authorization; the equipment was stolen from his home in a burglary

Vector: Albert Gonzalez and ShadowCrew crew 'wardrived' TJX store parking lots with laptop antennas, cracking WEP-encrypted Wi-Fi to access in-store networks, then moved laterally to TJX's central transaction database in Framingham, MA

Vector: Account compromise via knowledge-based authentication bypass — attacker used Paris Hilton's publicly known personal details (dog's name 'Tinkerbell') to correctly answer the T-Mobile Sidekick password reset security question, gaining access to her cloud-synced account data

Vector: Attackers gained unauthorized access to DSW's store networks through connections with other DSW stores; exploited lack of network segmentation and inadequate access controls to access point-of-sale transaction data stored in network files

Vector: Network intrusion — attackers breached DSW's in-store networks and accessed point-of-sale systems; DSW stored unencrypted payment card data including full magnetic stripe track data in transaction files on store systems, which were accessible via the corporate network

Vector: Fraudsters posed as legitimate small businesses and used stolen identities to create approximately 50 fake business accounts with ChoicePoint's data brokerage portal; then used those authorized accounts to legally purchase 163,000 consumer credit and identity records

Vector: SQL injection vulnerability in CardSystems' web application allowed attackers to access the payment processing database; CardSystems violated card network rules by retaining full magnetic stripe track data after transaction authorization

Vector: POS system compromise — attackers gained unauthorized access to BJ's wireless network and then to in-store point-of-sale systems; BJ's had stored full magnetic stripe track data and CVV2 codes indefinitely on its systems in violation of card network rules, enabling large-scale card counterfeiting

Vector: Attackers gained access to BJ's wireless network and exploited security weaknesses to intercept payment card data; BJ's stored full magnetic stripe data and CVV codes in violation of card network rules, and failed to use encryption on its wireless network

Vector: Scanned US military and NASA .mil/.gov domains for Windows machines with blank administrator passwords using a perl script and the RemotelyAnywhere admin tool; exploited default credentials to install backdoors and packet sniffers

Vector: Installed backdoor and network sniffer on a DTRA (Defense Threat Reduction Agency) server; intercepted usernames and passwords of DoD employees; also exploited vulnerabilities to access NASA's Marshall Space Flight Center network

Vector: Probe-then-exploit methodology: attackers scanned DoD systems for a known Solaris OS vulnerability, installed sniffers to harvest usernames/passwords, then returned to exfiltrate data — conducted through Israeli academic network as proxy

Vector: Russian state-sponsored actors (later linked to Turla APT) compromised US university and research institution computers as proxies, then used them to conduct systematic intrusions against DoD, NASA, DoE, and contractor networks — discovered when an administrator noticed late-night connections from a Cyrillic-keyboard system