The 10 Highest Profile Company Breaches of 2022
More than 4,100 publicly disclosed security breaches occurred in 2021, and cyber security publication Security Magazine predicts the final tally of 2022 breaches to exceed that amount by as much as 5%.
At Cyrus, we make military-grade personal cyber security protection available for all, keeping regular people and enterprise-level companies safer and more secure from hacks.
But hackers continue to target those who are less knowledgeable and safer in their online habits leading to high-profile breaches across many notable companies—many which made headline news over the course of 2022.
Let’s take a look at some of the highest profile company breaches of the year:
1. LastPass
LastPass announces hacks of user password vaults.
In late-December, password management service LastPass confirmed a security incident in which cybercriminals broke into customers’ encrypted password vaults, which store passwords and other confidential information. This expands upon an incident earlier in the year where a hacker compromised a LastPass developer account to steal company source code.
LastPass infiltrators were able to “copy a backup of customer vault data,” giving them vault access if they’re able to brute force guess the user’s master passwords. LastPass users with weak master passwords and two-factor authentication disabled are most at risk after this hack.
While Cyrus strongly recommends using a password manager for your accounts, it’s also vital to use a strong password for your master key to unlock your vault. Read more about password protection from Cyrus experts.
2. Twitter
Twitter data breach of 5.4 million users contact info.
Early in the year, Twitter announced an API vulnerability that led to the leak of 5.4 million users’ phone numbers and email addresses—however, they claimed none of that information was exploited.
However, it was revealed by BleepingComputer in November that the user data was in fact exposed on a dark web hacker forum, along with 1.4 additional Twitter profiles for suspended users also shared, with an even larger data dump also appearing from the same hack.
If you ever suspect your social media accounts have been compromised, Cyrus can help.
Protect Your Employees
Learn how your employees’ personal security impacts the state of your company’s cyber security.
3. Nvidia
Hackers breach Nvidia, demanding unlimited cryptocurrency mining.
Also in February, it was revealed that the LAPSUS$ hacking group claimed responsibility for a hack on Nvidia, America’s largest producer of microchips.
After taking their website offline, they threatened to leak 1TB in proprietary Nvidia data—including the passwords of 71,000 employees—in a ransomware attack requesting the removal of cryptocurrency mining limits on Nvidia graphics cards.
The hacking group was able to obtain employee credentials through a phishing campaign, the hackers’ preferred method of breaching systems.. As Nvidia declined the hacker’s ransomware requests, the information was released.
4. Cash App
Block’s Cash App went public with a data breach early in April, after an ex-employee downloaded internal reports containing American users’ personal information—including names and account numbers for more than 8 million users of Cash App Investing.
Cash App notified law enforcement of the hack and brought on a forensics firm to investigate the situation. Fortunately, the leaked data did not contain security codes or passwords, but trading activity and portfolio information was a part of the breach.
5. Public school ransomware attacks on the rise
Across the United States, K-12 public schools are increasingly targeted by ransomware hackers, according to a recent report from cybersecurity firm Palo Alto Networks.
The researchers found a specific hacking group called Vice Society has been targeting the education sector, hacking into systems and stealing data, holding student information hostage in exchange for huge sums of money.
As most schools don’t have dedicated cybersecurity teams to handle security issues, they’ve become increasingly more vulnerable to hacks, especially as more student data moves online due to remote learning.
6. The Red Cross
The Red Cross is breached, leaking data for 500,000+ people
Early in January, the International Committee for the Red Cross announced a data breach, losing personal data for more than half a million people worldwide. The source of the hack was a contractor in Switzerland who was storing the data and was the target of a spear phishing attack.
In a statement, the Red Cross pleaded with the hackers to keep the stolen data confidential, and worked closely with specialized firms to assist in dealing with the attack. The Red Cross now works to inform people about the importance of protecting humanitarian organizations from hackers.
7. Twilio
Twilio user data breached, including enterprise 2FA info.
In August, cloud-based communication platform Twilio announced a social engineering attack on employees. A number of current and former employees received SMS messages that appeared to come from Twilio’s IT team, asking if the recipient’s password had expired or schedule had changed, and requested credentials to log in.
Almost immediately after obtaining employee login info, hackers obtained data of more than 150 Twilio enterprise customers. To make matters worse, the hack also compromised nearly 100 users of their Authy software, which enables 2FA login credentials.
While two-factor authentication is something we highly suggest setting up for sensitive accounts, hackers are always devising new ways to trick users into handing over authentication codes.
8. DoorDash
DoorDash customers hacked using Twilio 2FA data.
After the attack on Twilio’s Authy, DoorDash customers were alerted later in August that a threat actor gained access to the company’s internal tools using the stolen 2FA data. The exposed info included the names, email addresses, delivery addresses, and phone numbers of customers, along with partial credit card information for some.
With phishing attacks up 400% since last year, the DoorDash attack illustrates the chain effect hacks can have across companies and sectors, proving the importance of broadly adopted high-security standards for all businesses. Learn more about how Cyrus can protect your business.
9. OpenSea
OpenSea hacked, user emails leaked and $1.7M in crypto stolen.
In February, OpenSea was completing a migration, opening an opportunity for a phishing attack. It is speculated that OpenSea users were tricked into partially signing a contract, allowing hackers to complete the missing portions that transferred crypto asset ownership.
Since the attack, OpenSea has begun warning users about email phishing, and implemented new security policies that make it more difficult to download customer data. They also terminated an employee suspected to have worked with the hackers, reporting that person to law enforcement.
10. WhatsApp
Hacker selling WhatsApp user data on the dark web
Over Thanksgiving weekend, a hacker claimed to be selling up-to-date information of 487 million WhatsApp users across 84 countries. The hacker posted to the dark web, offering to sell user datasets for up to US$7,000. According to Check Point Research, the list was “on sale for four days and is now being distributed for free among dark web users.”
Cyrus performs real-time scans of the dark web for any indication that your credentials have been leaked or is available for sale. You are immediately alerted if your information is detected, and our experienced team helps you take measures to secure your accounts.
Providing enterprise-ready personal cyber security for employees and personal accounts across the internet, Cyrus ensures a safer online experience everywhere you and your teams are connected.
For more information on how Cyrus can protect your business, book a demo today.
Protect Your Employees
Learn how your employees’ personal security impacts the state of your company’s cyber security.
