Here is a list of Data Breaches for 2019.
Note that this data is from reported data only. There are many more attacks for 2019. But this gives you insight into the number of companies that are vulnerable. Yes we all are vulnerable. Hackers have no preference and are equal opportunity attackers.
Blur
January 2, 2019: It didn’t take long for the first major breach announcement of 2019. Blur announced a breach after an unsecured server exposed a file containing 2.4 million user names, email addresses, password hints, IP addresses, and encrypted passwords. The password management company urged their users to change their Blur login credentials and enable two-factor authentication.
Town of Salem Video Game
January 3, 2019: The information of 7.6 million gamers was stolen in a hack of Town of Salem. BlankMediaGames (BMG) announced that its server was compromised and usernames, email addresses, IP addresses, game & forum activity, and purchased game premium features were exposed.
DiscountMugs.com
January 4, 2019: Online retailer of custom mugs and apparel, DiscountMugs.com was hacked for a four-month period in the latter half of 2018. The company announced that it had discovered malicious card skimming code placed on its payment website. Hackers were able to steal full payment card details (number, security code, and expiration date), names, addresses, phone numbers, email addresses, and postal codes.
BenefitMall
January 7, 2019: U.S. provider of payroll, HR, and employer services, BenefitMall announced a data breach that occurred after an email phishing attack compromised employee login credentials. Though the exact number of records exposed hasn’t been released, the emails may have included customer names, addresses, Social Security numbers, dates of birth, bank account numbers, and information on the payment of insurance premiums.
OXO
January 10, 2019: New York-based manufacturer, OXO was hacked in two separate incidents over the past two years, exposing customer information entered on their website. The company discovered unauthorized code on its site which captured customer names, billing and shipping addresses, and credit card information.
Managed Health Services (MHS) of Indiana
January 11, 2019: The personal health information of more than 31,000 patients of Managed Health Services of Indiana has been exposed following a phishing attack. Names, insurance ID numbers, addresses, dates of birth, and medical conditions are among the potentially compromised data.
Fortnite
January 16, 2019: A flaw within the online video game Fortnite has exposed players to being hacked. According to the security firm Check Point, who discovered the vulnerabilities, a threat actor could take over the account of any game player, view their personal account information, purchase V-bucks (in-game currency), and eavesdrop on game chatter. Fortnite has 200 million users worldwide, 80 million of whom are active each month.
Oklahoma Department of Securities
January 17, 2019: Millions of government files, including records pertinent to FBI investigations, were left unprotected on an open storage server belonging to the Oklahoma Department of Securities (ODS). The oldest records exposed dated back to 1986 and ranged from personal data to login credentials and internal communication records.
Collection 1
January 17, 2019: Security researcher Troy Hunt discovered a massive database on cloud storage site, MEGA, which contained 773 million email addresses and 22 million unique passwords collected from thousands of different breaches dating back to 2008. The information was shared on a popular hacking forum where they could be shared about. If you’re concerned if your credentials could may have been compromised, visit Have I Been Pwned?
BlackRock Inc.
January 22, 2019: As many as 20,000 financial advisers had their information leaked by the world’s largest asset manager, BlackRock. The company posted confidential sales documents related to advisers who work with BlackRock’s iShares unit. Names, emails, and assets managed by advisers were among the information exposed.
Graeters Ice Cream
January 22, 2019: Cincinnati-based purveyor of sweets, Graeter’s Ice Cream has notified approximately 12,000 customers who purchased items through the company’s online store. Malicious code was found on the website’s checkout page, which could capture customer names, addresses, phone numbers, fax numbers, payment card type, payment card numbers, expiration dates, and verification codes.
Online Betting Sites
January 23, 2019: Three online betting sites copied data containing 108 million records to Elasticsearch cloud storage without securing it. If you’ve placed bets via kahunacasino.com, azur-casino.com, easybet.com, or viproomcasino.net your information was likely exposed, including: names, addresses, phone numbers, email addresses, birth dates, usernames, account balances, IP addresses, browser and OS details, games played, and win and loss information.
Ascension
January 23, 2019: More than 24 million mortgage and banking documents sat unprotected in an online database for at least two weeks. According to the report from TechCrunch, the data leak was traced back to Fort-Worth, TX-based Ascension, a data analytics company who serves the financial services industry. The documents included people’s names, addresses, dates of birth, Social Security numbers, and financial information.
Alaska Department of Health & Social Services (DHSS)
January 23, 2019: A cyberattack targeting Alaska’s Division of Public Assistance has exposed data on at least 100,000 people. The attacker was able to access the names, Social Security numbers, dates of birth, addresses, health information, and income of people who applied for government programs.
Rubrik
January 29, 2019: IT security and cloud data management provider, Rubrik exposed a massive database containing customer information including names, contact information, and other details related to corporate accounts. The data leak was discovered on an unprotected Amazon Elasticsearch server that didn’t require a password.
Critical Care, Pulmonary & Sleep Associates (CCPSA)
January 31, 2019: Patients of the Colorado-based healthcare facility had their personal health information exposed after CCPSA employees fell for a phishing attack. Approximately 23,000 people have been notified of the breach, which included names, medical information, dates of birth, addresses, Social Security numbers, and driver’s licenses.
Houzz
February 1, 2019: Popular home improvement startup, Houzz announced a data breach affecting users of the platform. In a statement, the company said that information such as names, city, state, country, profile description, username, and hashed passwords were taken by an unauthorized third party.
Catawba Valley Medical Center
February 4, 2019: Patients of North Carolina-based Catawba Valley Medical Center have had their names, birth dates, Social Security numbers, and Personal Health Information (PHI) exposed in a cyberattack. Three employee email accounts were hacked in a phishing scam between July and August 2018. An estimated 20,000 patients have been impacted.
Huddle House
February 4, 2019: The point of sale systems of U.S.-based restaurant chain, Huddle House were compromised through a third party vendor’s system, giving hackers the ability to install malware to capture the payment card information of customers between August 2017 and February 2019.
EyeSouth Partners
February 6, 2019: Over 24,000 patients of Georgia-based EyeSouth Partners are being notified of a breach. The breach occurred after an unauthorized third party gained access to an employee email account – a trend we’ve seen all too much of in recent times. Patient names, health insurance information, and some account balance information were compromised.
Dunkin’ Donuts
February 12, 2019: For the second time in three months, Dunkin’ Donuts announced a data breach affecting DD Perks rewards members. Hackers used credential stuffing attacks to gain access to customer accounts, and have been selling them on the Dark Web for profits.
Coffee Meets Bagel
February 14, 2019: Love was not in the air for users of dating app Coffee Meets Bagel, who announced a data breach on Valentine’s Day. The names and email addresses of all users who registered before May 2018 were exposed, impacting approximately 6 million people.
500px
February 15, 2019: The accounts of 14.8 million users of 500px have been hacked, revealing full names, usernames, email addresses, birth dates, locations, and gender. The photo sharing website has notified its users and is forcing a password reset.
North Country Business Products
February 19, 2019: A data breach affecting North Country Business Products, a vendor of credit card processing services, has impacted at least 50 businesses across the state of Arizona. Customers of any of the following businesses between January 3rd and 24th, 2019, have had their name, credit card number, expiration date, and CVV compromised.
Advent Health
February 20, 2019: Patients of Florida-based Advent Health Medical Group are being notified of a 16-month long data breach. Approximately 42,000 individuals had their sensitive personal and health information exposed, including medical histories, insurance information, Social Security numbers, names, phone numbers, and addresses.
Coinmama
February 20, 2019: The usernames and hashed passwords of 450,000 users of Coinmama were recently posted on a dark web registry. The cryptocurrency broker has notified its customers and has encouraged all users to change their passwords.
UW Medicine
February 20, 2019: Nearly 1 million patients have been notified of a UW Medicine data breach, which was discovered December 26, 2018. A vulnerability on the health network’s website server exposed protected health information including names, medical record numbers, and a description of each individual’s information.
UConn Health
February 22, 2019: In another major data breach of a university health facility, patients of UConn Health have had their personal information exposed after a third party accessed employee email accounts. About 326,000 people were affected in the breach, which compromised names, dates of birth, addresses, Social Security numbers, and limited medical information.
Dow Jones
March 1, 2019: A database containing 2,418,862 identity records on government officials and politicians from every country in the world was leaked online from a Dow Jones watchlist. The watchlist is compiled from publicly available information on prominent individuals who have the ability to embezzle money, accept bribes, or launder funds.
Rush University Medical Center
March 4, 2019: About 45,000 patients of Chicago-based Rush health system were exposed in a data breach. Names, addresses, birthdays, Social Security numbers, and health insurance information were compromised after an employee disclosed billing documents to an unauthorized third party.
Health Alliance Plan
March 6, 2019: The protected medical information of 120,000 patients has been exposed in a Health Alliance Plan data breach. The names, addresses, dates of birth, member ID numbers, healthcare provider names, patient ID numbers, and claim information were compromised after a ransomware attack infiltrated Wolverine Solutions Group, a third-party vendor who manages the network’s mailing services.
Pasquotank-Camden Emergency Medical Services
March 12, 2019: An estimated 20,420 people have been affected in a cyberattack on North Carolina-based EMS company, Pasquotank-Campden Emergency Medical Services. The company’s billing information server was infiltrated by an unauthorized third party, leading to the exposure of Social Security numbers, dates of birth, and medical information.
Spectrum Health Lakeland
March 15, 2019: Michigan-based Spectrum Health Lakeland has announced it was also impacted in the hack of Wolverine Services Group, a mail vendor that works with multiple healthcare networks. Approximately 60,000 patients had their names, addresses, health services rendered, health insurance and billing information exposed.
Rutland Regional Medical Center
March 19, 2019: More than 72,000 patients have had their personal information exposed in a Rutland Regional Medical Center data breach. Patient names, contact information, medical record numbers, and 3,683 Social Security numbers were compromised after several employees email accounts were accessed illegally.
Zoll Medical
March 20, 2019: The personal information of 277,319 patients has been exposed by a Zoll Medical data breach. The medical device manufacturer headquartered in Chelmsford, MA announced that data from emails was leaked during a server migration, including names, addresses, dates of birth, and medical information. Some patients also has their SSN exposed.
MyPillow & Amerisleep
March 21, 2019: Bedding retailers MyPillow & Amerisleep experienced a breach at the hands of Magecart, a hacking syndicate that targets eCommerce websites with credit card skimming software. Hackers also set up a dummy URL to trick shoppers who made a typo in trying to visit the site.
March 21, 2019: Facebook has admitted that since 2012 it has not properly secured the passwords of as many as 600 million users. These passwords were stored in plain text and able to be accessed by more than 20,000 of the company’s employees. If you use Facebook, change your password.
Oregon Department of Human Services (DHS)
March 21, 2019: The Oregon Department of Human Services announced a data breach after nine of its employees clicked on a phishing link, compromising nearly 2 million emails. These emails may have exposed the names, addresses, dates of birth, Social Security numbers, and other information of as many as 1.6 million clients.
Federal Emergency Management Agency (FEMA)
March 22, 2019: Survivors who sought shelter assistance after hurricanes Maria and Irma, as well as California wildfires, have had their PII exposed in a FEMA privacy incident. About 2.5 million disaster victims had information like names and addresses, bank account information and birth dates shared with a contractor, leaving them unprotected.
Family Locator
March 23, 2019: A tracking app that allows family members to track each other’s location in real-time, Family Locator leaked data exposing more than 238,000 users. The locations of users was left accessible on an unprotected server, and included additional information such as name, email address, profile photo, and passwords.
Milestone Family Medicine
March 25, 2019: The names, addresses, dates of birth, health insurance information, Social Security numbers, and service information of 32,178 patients may have been stolen in a Milestone Family Medicine data breach.
Verity Health Systems
March 26, 2019: A hacker gained access to three of Verity Health Systems employee email accounts, compromising the protected health information of 14,894 patients. The sensitive data included names, patient ID numbers, dates of birth, addresses, phone numbers, health insurance information, payment information, driver’s licenses, and Social Security numbers.
Earl Enterprises
March 29, 2019: The parent company of Buca di Beppo, Earl of Sandwich, Planet Hollywood, Chicken Guy!, Mixology and Tequila Taqueria, Earl Enterprises announced a breach of its payment systems after discovering malware that stole customer credit and debit card information. More than 2 million customers were impacted.
Verifications.io
March 29, 2019: A database controlled by email validation company Verifications.io was discovered on an unprotected server that was accessible to anyone who knew where to look. Nearly 1 billion email accounts, along with other personal information, were exposed in one of the largest single-source data breaches ever recorded. The company has seemingly closed its doors after news of the breach broke.
Georgia Tech
April 2, 2019: Personal information of current and former faculty, students, staff and student applicants of Georgia Tech were accessed by a hacker through a central database. The database affected by the breach includes names, addresses, Social Security Numbers and birth dates of 1.3 million individuals. This is the university’s second breach in less than a year.
April 2, 2019: Two third-party applications which hold Facebook datasets were left exposed to the public online. Over 540 million records, including account names, Facebook ID, and user activity were exposed through Cultura Colectiva. The second application, At the Pool, disclosed passwords along with information regarding photos, events, groups, check-ins and more.
Baystate Health
April 8, 2019: An estimated 12,000 patients of Springfield, MA-based hospital, Baystate Health had their information exposed after a phishing attack compromised the email accounts of several employees. Patient names, dates of birth, health information, and some Medicare and Social Security numbers were involved in this healthcare data breach.
Prisma Health
April 10, 2019: A phishing attack on Prisma Health of South Carolina gave hackers unauthorized access to several employee email accounts. The investigation into the attack determined that 23,811 patients had their protected health information exposed, including names, health insurance information, Social Security numbers, and financial information.
City of Tallahassee
April 15, 2019: Nearly $500,000 of the city of Tallahassee employees’ payroll was stolen by hackers who redirected direct deposits into an unauthorized account. City officials responsible for investigating the incident suspect the cyberattack came from a foreign nation.
Microsoft Email Services
April 15, 2019: In a statement to TechCrunch, Microsoft admitted a data breach of its non-corporate email services, including @msn.com, @hotmail.com, and @outlook.com. The breach, which lasted from January 1 to March 28, 2019, allowed hackers to access email accounts by misusing Microsoft’s customer support portal.
Steps to Recovery
April 19, 2019: Patients seeking treatment for drug and alcohol abuse have had their sensitive personal information exposed in a data breach of several addiction rehabilitation centers. The data was discovered unprotected by security researcher, Justin Paine. Approximately 145,000 patients have been impacted.
EmCare
April 20, 2019: As many as 60,000 patients and employees of Florida’s EmCare have been notified of a data breach after a third party gained access to several employees’ email accounts. Those email accounts contained personal information including names, dates of birth, age, clinical information, and some Social Security and driver’s license numbers.
Bodybuilding.com
April 22, 2019: The largest online retailer of fitness supplements, Bodybuilding.com announced a data breach that potentially impacted its 7 million registered users. The company has since forced a password reset and notified its customers. The information that could have been stolen by hackers includes names, email addresses, billing/shipping addresses, phone numbers, order history, birth date, and information included in BodySpace profiles.
Atlanta Hawks
April 25, 2019: Magecart, a notorious hacking syndicate known for targeting online shopping portals, compromised the eCommerce website of the NBA’s Atlanta Hawks. The hackers installed a credit card skimming code on the site, stealing the names, dates of birth, and payment card details of anyone who shopped on the site after April 20, 2019.
Docker Hub
April 29, 2019: Users have been notified of a Docker Hub data breach after hackers exposed the information of 190,000 account holders. The company offers cloud-based services to application developers and programmers. Information stolen in the breach includes usernames, hashed passwords, Github, and Bitbucket tokens.
Unknown
April 29, 2019: Up to 65% of U.S. households have had their information exposed by an unsecured database housed on a Microsoft cloud server. While the owner of the data is unknown, over 80 million households have had their names, addresses, geographic location, age, dates of birth, and other demographic information compromised. VPNMentor, whose research team discovered the breach, is asking for help in identifying who the database belongs to.
Citrix
May 2, 2019: In a letter to potential data breach victims, Citrix revealed that hackers gained access to the company’s internal systems between October 2018 and March 2019. The U.S. software company in investigating the cyber intrusion with help from the FBI, but thinks that the data stolen could include the Social Security numbers, financial information, and other data on current and former employees.