Data Breaches 

Share

Latest news on Data Breaches, providing comprehensive coverage of data leaks, stolen data, exposed databases, leaked passwords and credentials, personal data theft, ransomware extortion, breach notifications, ICO and GDPR fines, class action lawsuits, identity theft, dark web leaks, Have I Been Pwned alerts and groups such as ShinyHunters, plus reports on how affected customers, patients and staff are told to respond.

A data breach happens when personal, financial or confidential information is accessed, copied, lost or published without permission. Common causes include hacking, stolen credentials, phishing, misconfigured cloud storage, insider misuse and attacks on suppliers holding data for others. Exposed details can include names, addresses, passwords, medical records and payment data, which fuel fraud and identity theft. Have I Been Pwned, launched by Troy Hunt in 2013, lets people check whether their email address was exposed.

Some attackers steal data to extort payment rather than only locking systems, threatening to publish files on leak sites. Extortion groups such as ShinyHunters and Clop have featured in major breach stories, often through a single shared supplier. In 2023 Clop exploited a flaw in MOVEit Transfer software, and one analyst count put the victims above 2,000 organisations. UK proposals to bar public bodies from paying ransoms have drawn both support and criticism from experts.

The ICO enforces UK rules, while authorities such as France's CNIL and Ireland's Data Protection Commission act under EU law. After a breach, organisations investigate, notify regulators and, where required, affected people, and usually advise changing passwords. Individuals commonly protect themselves with unique passwords, multi-factor authentication, password managers and credit file alerts. In 2024, attackers used stolen credentials on Snowflake customer accounts lacking multi-factor authentication, affecting companies such as AT&T and Ticketmaster.

Disclosure and penalties are recurring points of dispute. In 2022 a US jury convicted Uber's former security chief over concealing a 2016 breach affecting about 57 million users. Proposed penalties are sometimes cut sharply, as when the ICO reduced a provisional £45 million Capita fine to £14 million. Group legal claims by affected individuals have followed several large breaches, including a consumer class action over the Equifax incident.

California passed the first US state breach notification law, effective in 2003, and all 50 states have since followed. UK and EU GDPR rules require notifying the regulator within 72 hours of learning of a notifiable breach. Yahoo's 2013 and 2014 breaches, disclosed in 2016, led to a $350 million cut in Verizon's purchase price. Equifax agreed in 2019 to pay at least $575 million after a 2017 breach affecting about 147 million people.

Our NewsNow Data Breaches feed gathers headlines on data leaks, stolen personal data and breach notifications from reliable sources worldwide. It also follows ransomware extortion, ICO and GDPR fines and the cyber attacks behind them, giving readers an up-to-date view.