With another year come and gone, what better way to wrap it up than with a month by month review of the biggest hacks of 2015? Of course this list isn’t by any means comprehensive, these were just the most significant in terms of scope and method. And sometimes, there were so many hacks happening at the same time (think the Hacking Team and Ashley Madison) that news outlets didn’t know on which to report first. What fun! Here goes our list of the the biggest hacks, on a month by month basis.
On Jan 7th, Morgan Stanley was hacked by one of their own financial advisers, who accessed the financial records of over 350,000 clients. The ex-employee who stole the information, Galen Marsh, put the stolen records on sale on the internet in mid-December 2014 and the hack was exposed a few weeks later. What way to start the year!
The notorious Lizard Squad started their year off with a bang by hacking the website of Malaysia Airlines. The website was replaced with a 404 page sporting a picture of a lizard in top hat and monocle with the caption of “404 – Plane not found”, a reference to the ill-fated and still missing MH370, lost in March 2014. The airline stated that no user data was leaked but the Lizard Squad, also using the name Cyber-Caliphate, said it did access company data.
Anthem, the 2nd largest health provider in the US was hacked on February 4th. 78.8 million customers had their medical ID’s social security numbers, dates of birth, physical and email addresses and more stolen. These victims have been advised to stay vigilant about the high potential for ID theft for the rest of their lives.
Github, one of the largest and most respected open-source software repositories, was hacked early March. Github, essentially a place for developers to share and test new code, saw millions of software development projects at risk because of the hack. Originally it was assumed that China was behind the attack but then developer Egor Homokov came forth and admitted that he perpetrated it to point out a vulnerability that he had long been trying to call attention to. Thanks for the tip, Egor. He was thrown out of GitHub but his account was reinstated just a few days later.
TV5Monde, an international French-language television station was hacked by the Cyber-Caliphate (not connected to the other Cyber-Caliphate/Lizard Squad) in April. The hack knocked down the station for 18 hours and took over their website, Twitter and Facebook accounts. The hackers, initially thought to be satellites of ISIS, posted personal information about French soldiers on the hacked social media accounts. After the hack was resolved, though it became clear that the hack was the work of the Russian APT group, or an advanced persistent threat group called ATP28 or Pawn Star.
Internal Revenue Service
It’s been said that there are only two sure things in this world – death and taxes. You can add one other sure thing to the IRS’s list of sure things – hacks. In late May the Internal Revenue Service announced that the private tax information of over 320,0000 taxpayers had been stolen. By using social security numbers stolen in prior cyber crimes, the hackers were able to leach information about tax returns and more.
Office of Personnel Management
After the IRS attack it might have seemed like things couldn’t get any worse for the government. Then came the hack of the Office of Personnel Management.The OPM is the government agency in charge of hiring and retaining government employees. Understandably, information on who works in certain agencies and in what capacity can be highly sensitive.The fingerprints of 5.6 million federal employees were stolen, creating a huge security risk for certain government agencies as well as military records, addresses, dates of birth and all sorts of other identifying information.The attack has been unofficially attributed to China but at the moment that theory has yet to be proven.
The Hacking Team
Talk about karma. In July, The Hacking Team, makers of cyber-surveillance tools for government agencies around the world got hacked themselves. Well, when you use passwords like passw)rd and passwrd1, you’re likely to end up hacked. Then it was revealed that the Italy-based firm was apparently selling their software to some of the most oppressive regimes around the world, which it had firmly denied doing in the past. On all accounts, they should have known better.
Again, karma rules in July. Ashley Madison, the website that enabled extramarital affairs was hacked by a group calling itself The Impact Team. The group gave the sites’ parent company ALM, one month to shut the site down or face having user information dumped on to the internet. ALM kept the site running and on August 18th and 20th, 25 gigabytes of information were released on to the internet. There was one confirmed user suicide connected to the leak and other unconfirmed ones as well. The perps have yet to be found, though theories abound as to whom is responsible.
The British mobile phone retailer Carphone warehouse was hacked, putting the banking information of over 2.4 million customers at risk. According to the Gaurdian.com “ the attack also affected customers of OneStopPhoneShop.co.uk, e2save.com and Mobiles.co.uk, and Carphone Warehouse also provides services to TalkTalk Mobile, Talk Mobile, and to its own recently launched iD mobile network.”
Hotelier giant, Hilton Hotels was the victim of a point-of-sales hack to their credit card system. Security journalist Brian Krebs broke the story using information he gathered from numerous sources at different banks and before long it was confirmed that there had been a breach of the credit card system used at the hotels restaurants and gift shops. Affected branches of the chain include Embassy Suites, Hampton Inn’s, DoubleTree and Waldorf-Astoria
Oh look, it’s TalkTalk again. The British Mobile Service provider, affected in the Carphone Warehouse hack, was again hacked in October. The names, and account information of 157,000 customers and the banking information of some 15,000 customers were stolen by a group of teenagers and 20-somethings to be sold on the darkweb. TalkTalk CEO Dido Harding came under fire for her nonchalant attitude regarding the hack, telling reporters “ We are head and shoulders better than some of our competitors” in terms of their cyber security. Uh huh, sure.
In late November, tech-toy giant VTech was hacked. VTech, makers of learning laptops and other IoT gadgets for kids found their servers breached by a 21 year old, self-proclaimed ethical hacker, attempting to expose vulnerabilities that could affect kids.The hack exposed the data of over 11 million people, more than half of whom are minors. The information exposed included names, genders and birth dates for minors plus passwords, email addresses and IP information for adults.The hacker has since been arrested and is awaiting trial and VTech has found itself in a huge amount of hot water for their lax security measures.
Yesterday, Softpedia reported that a Lizard Squad copycat group named Phantom Squad (c’mon, a bit of originality, please?) has been threatening to shut down popular websites with distributed denial of service attacks this coming Christmas day, echoing Lizard Squad’s takedown of xBox and Sony Play station last December. A DDoS attack is when a website is bombarded with traffic by hackers with the intention of sending so much traffic to the site that their servers can’t handle the influx, and therefore shut down. The hackers claim to have started such a DDoS attack against reddit that has yet to materialize so their claims may all just be hot air, but only time will tell.
Have anything to add to our year in review? Did we miss anything Let us know!