The Week in Cyber Security and Data Privacy: 22 – 28 January 2024

Welcome to this week’s global round-up of the biggest and most interesting news stories.

At the end of each month, these incidents – and any others that we find – will be used to inform our monthly analysis of data breaches and cyber attacks.


Publicly disclosed data breaches and cyber attacks: in the spotlight

The ‘mother of all breaches’: more than 26 billion records exposed

The security researcher Bob Diachenko and investigators from Cybernews have discovered an open instance with 26 billion data records, mostly compiled from previous breaches – although it likely also includes new data.

The data is more than mere credentials, too – according to Cybernews, most of the exposed data is sensitive. Given the extraordinary scale of the data breach, it’s been dubbed the ‘MOAB’ (mother of all breaches). In total, 3,876 domain names were included in the exposed data set.

Data breached: more than 26 billion records.

Ukrainian cyber attack allegedly wipes 2 PB of data belonging to Russian research centre

The Main Directorate of Intelligence of the Ministry of Defense of Ukraine claims to have destroyed a 2-PB (petabyte) database belonging to Russia’s Far Eastern Research Center for Space Hydrometeorology, or Planeta.

With the caveat that news of state-sponsored attacks against combatants during wartime must be treated with a certain degree of caution, it appears that the cyber attack on Planeta – which receives and processes satellite data on behalf of more than 50 Russian state entities, including the Ministry of War – destroyed 280 servers at a cost of “at least $10 million”.

Data breached: 2 PB.

Mobile network database breach exposes 750 million Indians’ personal data

The Indian security company CloudSEK claims to have found the personal data of 750 million Indians for sale on an “underground forum”. Compromised data includes victims’ names, addresses, phone numbers and Aadhaar numbers (a 12-digit government identification number).

It remains unclear how the data breach occurred, but the attackers apparently suggested it was the result of “exploiting vulnerabilities within government databases of telecommunication systems”.

Data breached: 750 million victims’ personal data.


Publicly disclosed data breaches and cyber attacks: full list

This week, we’ve found 3,154,222,180 records known to be compromised, and 183 organisations suffering a newly disclosed incident. On top of that, we found out about the MOAB this week, affecting 3,876 organisations with more than 26 billion records breached.

Excluding the MOAB, 165 of newly breached organisations this week are known to have had data exfiltrated, exposed or otherwise breached. Only 1 definitely hasn’t had data breached.

We’ve also found 6 organisations providing a significant update on a previously disclosed incident.

Organisation(s)SectorLocationData breached?Known records breached
3,876 domain names (the ‘mother of all breaches’ or ‘MOAB’)
Source
(New)
MultipleMultipleYesMore than 26,000,000,000
Far-Eastern Center of State Research Center for Space Hydrometeorology (Planeta)
Source 1; source 2
(New)
PublicRussiaYes2 PB
Indian mobile network consumer database (probably)
Source 1; source 2
(New)
TelecomsIndiaYes750,000,000
Telekom Malaysia
Source 1; source 2
(New)
TelecomsMalaysiaYesAlmost 200,000,000
IPL Consulting
Source 1; source 2
(New)
IT servicesRussiaYesMore than 60 TB
Public Health Ministry’s Immunization Centre? (9near.org)
Source 1; source 2
(New)
PublicThailandYes55,000,000
Moscow International Higher Business School
Source
(New)
EducationRussiaYes27,915,905
loanDepot
Source 1; source 2
(Update)
FinanceUSAYes16,600,000
Trello
Source 1; source 2
(New)
SoftwareUSAYes15,115,516
Concentra
Source 1; source 2
(New)
HealthcareUSAYes3,998,162
At Home Group Inc.
Source
(New)
RetailUSAYes2,588,849
Keenan & Associates
Source 1; source 2
(Update)
InsuranceUSAYes1,509,616
AGC Group
Source
(New)
ManufacturingJapanYes1.5 TB
Four Hands
Source
(New)
ManufacturingUSAYes1.5 TB
JD Sports Fashion
Source
(New)
RetailUKYes1,493,344
Microbe&Lab
Source
(New)
HealthcareNetherlandsYes1,285,279
Stemcor Global Holdings Limited
Source
(New)
RetailUKYes1.2 TB
UK forex customers
Source
(New)
FinanceUKYes1,001,214
A.N.S. Computer SPRL
Source
(New)
IT servicesBelgiumYes1,000,000
AerCap
Source
(New)
TransportIrelandYes1 TB
MBC Law Professional Corp.
Source
(New)
LegalCanadaYes1 TB
Double Eagle Development
Source
(New)
Real estateUSAYes904,980
Southern Water
Source 1; source 2; source 3
(New)
UtilitiesUKYes750 GB
BuidlersTribe
Source
(New)
Professional servicesSingaporeYesMore than 661,000
Dillard’s Inc.
Source
(New)
RetailUSAYes593,688
Mobile Premier League
Source
(New)
LeisureIndiaYes508,000
Chattanooga Imaging
Source 1; source 2
(New)
HealthcareUSAYesMore than 500,000
Schneider Saddlery
Source
(New)
RetailUSAYes451,503
Teen Patti Master
Source
(New)
LeisureIndiaYes400,000
Lucky Brand
Source
(New)
RetailUSAYes374,482
High Arctic Energy Services
Source
(New)
EnergyCanadaYes345 GB
Jason’s Deli
Source
(New)
HospitalityUSAYes344,034
Ulta Beauty
Source
(New)
RetailUSAYes327,936
Jay Group
Source
(New)
TransportUSAYes270 GB
Corelle Brands
Source
(New)
ManufacturingUSAYes244,108
Daeyang University
Source
(New)
EducationMalawiYesMore than 224,000
B.TECH
Source
(New)
RetailEgyptYes203,265
Smith Affiliated Capital Corp.
Source
(New)
FinanceUSAYesMore than
200 GB
Planet Home Lending, LLC
Source
(New)
FinanceUSAYes199,873
Bonobos
Source
(New)
RetailUSAYes191,721
Draneas Law
Source
(New)
LegalUSAYes189 GB
Advance Auto Parts
Source
(New)
RetailUSAYes186,853
HORNE
Source 1; source 2
(New)
Professional servicesUSAYes170,052
WEBS – America’s Yarn Store
Source
(New)
RetailUSAYes157,895
The Mike Ferry Organization
Source
(New)
Real estateUSAYes136,221
Toronto Zoo
Source 1; source 2
(Update)
Non-profitCanadaYes130 GB
Urban Barn
Source
(New)
RetailUSAYes122,957
Ace Hardware Corporation
Source
(New)
RetailUSAYes122,452
Skechers
Source
(New)
RetailUSAYes113,753
First Financial Security
Source 1; source 2
(Update)
InsuranceUSAYes105,764
Value City Furniture
Source
(New)
RetailUSAYes104,312
A24Group Medical Staffing
Source
(New)
HealthcareUKYes10 GB
The Company Store
Source
(New)
RetailUSAYes89,007
Kansas Joint & Spine Specialists
Source 1; source 2
(New)
HealthcareUSAYes83,869
Dooney & Bourke
Source
(New)
RetailUSAYes80,956
Books A Million
Source
(New)
RetailUSAYes69,988
Michigan Orthopaedic Surgeons
Source 1; source 2
(New)
HealthcareUSAYes67,477
Sam Ash Music
Source
(New)
RetailUSAYes66,991
Nassau Vision Group
Source
(New)
ManufacturingUSAYes63 GB
Jerry’s Artarama
Source
(New)
RetailUSAYes56,280
VELUX USA
Source
(New)
ManufacturingUSAYes51,097
BACT Consultation
Source
(New)
Professional servicesUAEYesMore than 44,000
American Signature Inc.
Source
(New)
RetailUSAYes42,771
Havertys Furniture
Source
(New)
ManufacturingUSAYes34,941
BrandSource
Source
(New)
ManufacturingUSAYes35,748
Dollar General
Source
(New)
RetailUSAYes31,699
Mi Argentina
Source
(New)
IT servicesArgentinaYes31,583
Danto.de
Source
(New)
RetailGermanyYes30,000
Integrity, Inc.
Source
(New)
Non-profitUSAYes25,908.62 MB
Ardent Health Services
Source 1; source 2
(Update)
HealthcareUSAYes23,686
Bake’n Joy Foods, Inc. and CommerceV3
Source
(New)
Manufacturing and IT servicesUSAYes21,914
Vans NL
Source
(New)
RetailNetherlandsYes17,761
Saudi car insurance portal
Source
(New)
InsuranceSaudi ArabiaYes14,183
Hinley
Source
(New)
ManufacturingUSAYes14,470
National Business Furniture
Source
(New)
ManufacturingUSAYes13,412
Avon
Source
(New)
ManufacturingUKYes12,861
VistaPrint
Source
(New)
RetailNetherlandsYes11,968
3Rivers Archery
Source
(New)
RetailUSAYes11,932
ColliShop
Source
(New)
RetailBelgiumYes10,291
Ventura County Credit Union
Source
(New)
FinanceUSAYes9,452
Double Eagle Energy Holdings IV LLC
Source
(New)
EnergyUSAYes9,088
Brady Martz & Associates
Source 1; source 2
(New)
FinanceUSAYes7,154
Ciudadano Digital
Source
(New)
IT servicesArgentinaYesMore than 7,000
Instituto Costarricense de Turismo
Source
(New)
LeisureCosta RicaYes6,361
HOM Furniture
Source
(New)
ManufacturingUSAYes6,226
Marywood Nursing Care Center
Source
(New)
HealthcareUSAYes6,178
Colorado Ophthalmology
Source 1; source 2
(New)
HealthcareUSAYes6,020
Cloud South
Source
(New)
IT servicesUSAYes5,128
Samsonite
Source
(New)
ManufacturingBelgiumYes5,108
Paula’s Choice Skincare
Source
(New)
ManufacturingUSAYes5,065
Lake County Health Department and Community Health Center
Source 1; source 2
(New)
PublicUSAYes5,000
Meyer Cookware
Source
(New)
ManufacturingUSAYes4,260
Valhalla Pure Outfitters
Source
(New)
RetailCanadaYes3,874
INTERPOL Argentina
Source
(New)
PublicArgentinaYesMore than 3,000
Connect Distribution
Source
(New)
RetailUKYes2,615
PetFlow
Source
(New)
ManufacturingUSAYes2,415
Center for Urban Community Services
Source
(New)
Non-profitUSAYes2,266
Orgain
Source
(New)
ManufacturingUSAYes2,198
New Balance
Source
(New)
ManufacturingUSAYes2,093
True Alliance
Source
(New)
RetailAustraliaYes1,764
The Brick
Source
(New)
RetailUSAYes1,744
PostWorks New York
Source
(New)
MediaUSAYes1,559
DiscountMags
Source
(New)
RetailUSAYes1,420
Hale Groves
Source
(New)
ManufacturingUSAYes1,417
Enterprise Bank & Trust
Source
(New)
FinanceUSAYes1,307
Naturepedic
Source
(New)
ManufacturingUSAYes1,284
Nautica
Source
(New)
RetailUSAYes1,168
Ricardo Defense Inc
Source
(New)
ManufacturingUSAYes1,149
Pittman & Davis, LLC
Source
(New)
RetailUSAYes1,136
Suja Organic
Source
(New)
RetailUSAYes1,111
Mount Vernon Dental Smiles
Source 1; source 2
(New)
HealthcareUSAYes1,069
PowerBar
Source
(New)
RetailUSAYes952
Walker Therapeutic & Educational Programs
Source 1; source 2
(New)
Non-profitUSAYes846
Catholic Heath Initiative Trinity Medical Center
Source 1; source 2
(New)
HealthcareUSAYes797
Smartpress
Source
(New)
RetailUSAYes566
FedEx Corporation Group Health Plan
Source
(New)
InsuranceUSAYes553
Covenant Care California, LLC
Source 1; source 2; source 3
(Update)
HealthcareUSAYes501
Daleville Dental LLC
Source 1; source 2
(New)
HealthcareUSAYes500
FootJoy
Source
(New)
RetailUSAYes445
Student.com
Source
(New)
Real estateUKYes414
National Right to Work Committee
Source
(New)
Non-profitUSAYes325
Mexican government
Source
(New)
PublicMexicoYesMore than 300
American Medical ID
Source
(New)
ManufacturingUSAYes248
GC Services
Source
(New)
FinanceUSAYes180
Drazin and Warshaw, P.C.
Source
(New)
LegalUSAYes163
Newington Fire Department
Source
(New)
PublicUSAYes127
M&T Bank
Source
(New)
FinanceUSAYes43
First Century Bank
Source
(New)
FinanceUSAYes23
Tanga
Source
(New)
RetailUSAYes16
The Hartford
Source
(New)
FinanceUSAYes15
Latham Centers, Inc.
Source
(New)
HealthcareUSAYes1
Justicia Córdoba
Source
(New)
LegalArgentinaYesUnknown
Ministerio de seguridad
Source
(New)
PublicArgentinaYesUnknown
Deknudt Frames
Source
(New)
ManufacturingBelgiumYesUnknown
Accolade Group Inc.
Source
(New)
RetailCanadaYesUnknown
GAMEE
Source
(New)
BlockchainCzech RepublicYesUnknown
CARRI Systems
Source
(New)
Professional servicesFranceYesUnknown
Mercedes-Benz AG
Source
(New)
ManufacturingGermanyYesUnknown
S&A Law Offices
Source
(New)
LegalIndiaYesUnknown
Gadot Biochemical Industries Ltd.
Source
(New)
ManufacturingIsraelYesUnknown
Neafidi Società Cooperativa di garanzia collettiva fidi
Source
(New)
FinanceItalyYesUnknown
CloudFire
Source
(New)
IT servicesItalyYesUnknown
High National Elections Commission
Source
(New)
PublicLibyaYesUnknown
DENHAM the Jeanmaker
Source
(New)
RetailNetherlandsYesUnknown
2 Togolese journalists
Source
(New)
MediaTogoYesUnknown
Ducon Industries FZCO
Source
(New)
ConstructionUAEYesUnknown
The Gainsborough Bath Spa
Source
(New)
HospitalityUKYesUnknown
Caravan and Motorhome Club
Source 1; source 2
(New)
LeisureUKYesUnknown
Covanta
Source 1; source 2
(New)
EnvironmentalUSAYesUnknown
Full Circle Electronics
Source 1; source 2
(New)
EnvironmentalUSAYesUnknown
Veolia North America
Source
(New)
EnvironmentalUSAYesUnknown
Dawson James Securities, Inc.
Source
(New)
FinanceUSAYesUnknown
First Mid
Source
(New)
FinanceUSAYesUnknown
Mordfin Group
Source
(New)
FinanceUSAYesUnknown
Aria Care Partners
Source 1; source 2
(New)
HealthcareUSAYesUnknown
Des Moines Orthopaedic Surgeons
Source 1; source 2
(New)
HealthcareUSAYesUnknown
Moses Lake Community Health Center
Source 1; source 2
(New)
HealthcareUSAYesUnknown
Signature Performance, Inc.
Source
(New)
HealthcareUSAYesUnknown
Hewlett Packard Enterprise
Source 1; source 2
(New)
IT servicesUSAYesUnknown
Sirius Federal
Source
(New)
IT servicesUSAYesUnknown
UICGS/Bowhead Family of Companies
Source
(New)
IT servicesUSAYesUnknown
Total Air Solutions, LLC
Source
(New)
Professional servicesUSAYesUnknown
Kansas City Area Transportation Authority
Source 1; source 2
(New)
PublicUSAYesUnknown
Phastar
Source 1; source 2
(New)
Research servicesUSAYesUnknown
David’s Bridal
Source
(New)
RetailUSAYesUnknown
Yesway
Source
(New)
RetailUSAYesUnknown
Anthropic
Source
(New)
SoftwareUSAYesUnknown
Kahua
Source 1; source 2
(New)
SoftwareUSAYesUnknown
PowerReviews
Source
(New)
SoftwareUSAYesUnknown
Concentric.fi
Source
(New)
CryptoUnknownYesUnknown
BUKA Magazin
Source
(New)
MediaBosnia and HerzegovinaUnknownUnknown
USAID Colombia
Source
(New)
PublicColombiaUnknownUnknown
RailTel Corporation of India Ltd
Source
(New)
TelecomsIndiaUnknownUnknown
Lev Cinemas
Source
(New)
LeisureIsraelUnknownUnknown
Sveriges Riksbank
Source
(New)
FinanceSwedenUnknownUnknown
The Misbourne
Source 1; source 2; source 3
(New)
EducationUKUnknownUnknown
Naftogaz of Ukraine
Source
(New)
EnergyUkraineUnknownUnknown
Monobank
Source
(New)
FinanceUkraineUnknownUnknown
Ukrtransbezpeka
Source
(New)
PublicUkraineUnknownUnknown
Ukrposhta
Source
(New)
TransportUkraineUnknownUnknown
Bakersfield College
Source
(New)
EducationUSAUnknownUnknown
EquiLend
Source 1; source 2
(New)
FinanceUSAUnknownUnknown
BrightStar Care
Source
(New)
HealthcareUSAUnknownUnknown
Bucks County
Source 1; source 2
(New)
PublicUSAUnknownUnknown
Nevada Gaming Control Board
Source 1; source 2
(New)
PublicUSAUnknownUnknown
U.S. Department of Health and Human Services
Source
(New)
PublicUSAUnknownUnknown
Washington County
Source
(New)
PublicUSAUnknownUnknown
Tesla
Source
(New)
ManufacturingUSANo0

Note 1: ‘New’/‘Update’ in the first column refers to whether this breach was first publicly disclosed this week, or whether a significant update was released this week. The updated data point is italicised in the table.

Note 2: For incidents where we only know the file size of the data breached, we use the formula 1 MB = 1 record. Given that we can’t know the exact numbers, as it depends on the types of records included (e.g. pictures and medical histories are considerably larger files than just names and addresses), we err on the side of caution by using this formula. We believe that this underestimates the records breached in most cases, but it is more accurate than not providing a number at all.


AI

Final draft of EU Artificial Intelligence Act leaked

Luca Bertuzzi, the technology editor of Euractiv, has shared the final draft of the EU’s AI Act, “ahead of a discussion within the Telecom Working Party, a technical body of the EU Council, on Wednesday and formal adoption at the ambassador level (i.e. COREPER) on 2 February”.

European Commission launches AI innovation package to support startups and SMEs

Following the political agreement on the AI Act, the European Commission has launched a package of measures to help European startups and small to medium-sized organisations develop AI that “respects EU values and rules”.

UK NCSC warns of rise in AI-enabled ransomware

The UK’s NCSC has warned that AI, which is already being used to facilitate cyber crime, “will almost certainly increase the volume and impact of cyber attacks – including ransomware – in the near term”. Its report concludes that AI lowers the barrier of entry to would-be attackers, enabling the relatively unskilled to carry out more effective campaigns.

US NAIRR to partner with AI developers

The US National Science Foundation, alongside 10 other federal agencies and 25 private-sector, non-profit and philanthropic organisations, has launched the NAIRR (National Artificial Intelligence Research Resource), with the aim of democratising the future of AI research and development. NAIRR will “provide access to advanced computing, datasets, models, software, training and user support to U.S.-based researchers and educators”.


Enforcement

UK, US and Australia sanction “Russia-based cyber hacker”

The UK, US and Australia have sanctioned the Russian national Aleksandr Ermakov, following his identification as a key actor in the cyber attack on Australia Medibank in 2022. The attack saw 9.7 million customers’ personal data leaked on the dark web.

CNIL fines Amazon France Logistique €32 million for GDPR breach

France’s supervisory authority, the CNIL, has fined Amazon France Logistique, the division that manages the Amazon group’s French warehouses, €32 million for monitoring employee behaviour in breach of the EU GDPR.

SolarWinds seeks dismissal of SEC cyber security lawsuit

SolarWinds Corp. and its CISO, Tim Brown, have filed a dismissal motion at New York federal court, denying SEC allegations of fraud and internal control failures relating to its cyber security practices following the cyber attack it suffered from 2019 to 2020.


Other news

Three new cyber security reports published

The Securonix 2024 Insider Threat Report looks at internal security risks, while the Malware Trends Overview Report: 2023 from Any Run examines the most prevalent malware types of 2023 and Coveware examines the latest ransomware trends.

noyb survey: 74.4% of experts say data protection authorities would find “relevant violations” at most companies

To mark this year’s Data Protection Day, the privacy rights campaign group noyb surveyed more than 1,000 data protection professionals in the EU. According to the resulting report, GDPR: a culture of non-compliance?, 35.8% of respondents agree that “the ‘deterring effect’ of the GDPR has been lost over the last five years”, 70.9% “think that we need more clear decisions by [data protection authorities] and courts to improve compliance” and 74.4% “assume relevant violations at an average company”.


Key date

19 March 2024 – UK government calls for views on Cyber Governance Code of Practice

The UK government is calling for views on its draft Cyber Governance Code of Practice, which aims to help organisations manage cyber risks. Responses must be submitted by 11:59 pm on Tuesday, 19 March 2024.


That’s it for this week’s round-up. We hope you found it useful.

We’ll be back next week with the biggest and most interesting news stories, all rounded up in one place.

In the meantime, if you missed it, check out last week’s round-up. Alternatively, you can view our full archive.


Security Spotlight

To get news of the latest data breaches and cyber attacks straight to your inbox, subscribe to our weekly newsletter: the Security Spotlight.

Every Wednesday, you’ll get a 4-minute email with:

  • Industry news, including this weekly round-up;
  • Our latest research and statistics;
  • Interviews with our experts, sharing their insights and expertise;
  • Free useful resources; and
  • Upcoming webinars.