As 2016 comes to an end, we look back at six of the year’s worst data breaches and what went wrong.
It seems like not a day went by this year without reports of yet another major data breach, or two or three data breaches. From healthcare to fast food to adult entertainment, no industry was spared the wrath of hackers. Even the U.S. presidential election ended up being impacted by cyber security concerns, both real and perceived. Here, we review six of 2016’s worst offenders and what went wrong.
1. The Yahoo Data Breaches
What happened: Three months ago, Yahoo disclosed that it had fallen victim to the biggest security breach in history, which compromised 500 million user accounts, resulted in at least 23 lawsuits, and put the company’s planned acquisition by Verizon at risk. As if that weren’t bad enough, last week, Yahoo announced that it had uncovered yet another breach, this one involving a staggering 1 billion accounts and casting another dark shadow over the Verizon deal.
What went wrong: Yahoo is paying the price for spending years putting “the user experience” ahead of cyber security. Afraid that strong security measures would annoy its end users, Yahoo continued to release products that it knew were vulnerable to hacks. While social media networks are full of memes expressing consumer annoyance at security requirements such as strong passwords, it’s far better to risk annoying customers than to leave their personal information open to data breaches.
2. The DNC Email Hack
What happened: The 2016 U.S. presidential race was already shaping up to be one of the most contentious in modern history when, in an echo of the 2014 Sony Pictures email hack, WikiLeaks released a number of damaging emails stolen from the Democratic National Committee’s email server. While most of the messages consisted of boring, routine correspondence, others were quite scandalous, including what appeared to be messages written by high-ranking party officials plotting to discredit candidate Bernie Sanders and planning to reward high-dollar DNC donors with federal appointments had Hillary Clinton won the election. In the end, the scandal forced the DNC’s chairperson, CEO, and communications director to resign.
What went wrong: Among other missteps, the DNC chose to run its own enterprise email server. This is almost always a bad idea, as most organizations simply do not have the monetary and human resources to properly secure one. While outsourcing enterprise email to a provider such as Google is not a guarantee against data breaches, it’s a good proactive step to tilt the odds in the organization’s favor.
3. The Wendy’s Point-of-Sale System Hack
What happened: At nearly the same time Wendy’s announced it would be switching from human clerks to automated ordering kiosks, the fast-food giant disclosed that its existing point-of-sale systems had been hacked, compromising customer credit card information from 1,000 of its locations in the U.S. In a [failed] attempt to deflect responsibility, Wendy’s implied that the data breaches were not the company’s fault because “only” independently owned franchises, not company-owned locations, had been breached, and that the franchisees were the bad guys because they’d chosen the wrong third-party providers to service their POS systems.
What went wrong: In addition to trying to pass the buck, which is a bad idea on numerous levels, a class action lawsuit against the company on behalf of dozens of credit unions alleges that the company, similar to Yahoo, knew that its POS systems had security problems but declined to address the issues. As the old saying goes, the first step to solving a problem is admitting that you have one.
4. The SWIFT Network Attacks
What happened: The SWIFT Network, a proprietary messaging system that banks around the world use to communicate with each other, was thought to be one of the most secure systems on Earth – until hackers managed to get into it by breaching user banks’ systems, accessing their SWIFT credentials, and requesting billions of dollars in fraudulent money transfers. Most of these were caught and flagged, but about $81 million, from a bank in Bangladesh, went through. The hackers behind the attacks are still at large, and SWIFT, as well as banks around the world, remain at risk of similar heists.
What went wrong: The methods used by hackers to breach the user banks’ systems were not new or particularly sophisticated; it appears that they used email phishing schemes to steal login credentials from unwitting bank employees. Many security experts believe that SWIFT may have been dependent on “security through obscurity.” Before this year’s hack, few people outside the finance world had even heard of SWIFT. Unfortunately, the internet has brought even the most obscure technology into the light, and organizations can no longer depend on their systems being un-hackable because “nobody has ever heard of them.”
5. The FriendFinder Networks Data Breaches
What happened: What could possibly be more embarrassing than having your political party’s dirty laundry aired by WikiLeaks? Having your account on the “World’s Largest Sex and Swinger Community” made public. In October, FriendFinder Networks, the owners of numerous adult-oriented websites, disclosed that 412 million user accounts from six of its sites had been exposed, most of them from a swingers’ dating site called Adult FriendFinder. In addition to breaching user data, hackers also accessed source code and public/private key pairs.
What went wrong: Apparently, FriendFinder Networks learned absolutely nothing from the 2015 Ashley Madison hack. It stored its users’ email addresses and passwords in a wildly insecure manner, as plain text and converted to all lower-case. Because it engaged in few, if any, proactive cyber security measures, FriendFinder was a data breach waiting to happen.
6. The Hollywood Presbyterian Medical Center Ransomware Attack
What happened: While not technically a data breach, the ransomware attack on Hollywood Presbyterian Medical Center, which occurred in February 2016, set the stage for a spate of similar attacks on medical facilities in the United States, Canada, and the U.K. Hackers used ransomware to disable the hospital’s entire network, including its electronic health records (EHR) system. Desperate to get back in, the facility paid a $17,000+ ransom in Bitcoin. This greatly incentivized hackers by proving that they could easily extort big paydays from healthcare organizations.
What went wrong: It is believed that the Hollywood Presbyterian attack, like most ransomware attacks (and data breaches) occurred after hackers got hold of legitimate system login credentials, possibly through a phishing email or another social engineering scheme, then used them to get into the hospital’s systems and install malware. The healthcare industry is notorious for not providing its front-line employees with cyber security awareness training or taking other proactive steps to prevent ransomware attacks and data breaches.
Let’s hope that 2016 was the year everyone finally learned their lesson about the importance of proactive cyber security, and 2017 will be the year when organizations strike back against hackers.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.