2022 SaaS Breaches

December 31, 2022

Slack

Slack experienced a cyberattack where a limited number of employee tokens was stolen to gain access to the company’s externally hosted GitHub repository and private source code. Learn the details behind the Slack attack.

December 22, 2022

LastPass

LastPass released an updated statement confirming that customers’ 256 bit AES encrypted password data had been looted. The hacker was also able to copy a backup of customer vault data that includes both unencrypted data, encrypted fields like usernames and passwords, and form-filled data. Read how LastPass attackers accessed password vaults.

Dec 1, 2022

AstraZeneca

In 2021, a developer accidentally left their Salesforce Cloud login credentials exposed in a GitHub repo. Fast forward to 2022, security researchers found the repo, logged in, and stumbled upon sensitive data. PII was not exposed. Read more about the AstraZeneca data exposure.

November 30, 2022

LastPass

LastPass notified its customers that an unauthorized party had accessed certain elements of customers’ information within a third party cloud storage service shared with GoTo (formerly LogMeIn). See how the Aug. 2022 hacking incident allowed exfiltration of encrypted customer data.

November 1, 2022

Dropbox

Dropbox suffered a data breach of their internal GitHub code repositories that included API keys. Dropbox employees were targeted with phishing emails that led them to an imitation CircleCI login page and also prompted them to enter a One-Time Password (OTP). Learn how the Dropbox attacker accessed a GitHub repo.

October 28, 2022

Twilio

Twilio disclosed a second breach by 0ktapus hackers where an employee was socially engineered through voice phishing (vishing). The Twilio employee provided their corporate credentials, enabling the attacker to access customer contact information for a “limited number” of customers. Read about Twilio’s second 0ktapus incident.

October 18, 2022

Verizon

Verizon alerted customers of a cyberattack that granted third party actors access to their accounts. The breach exposed the last four digits of customers’ credit cards to make payments on their prepaid accounts, and potentially enabled attackers to process unauthorized SIM card changes on prepaid lines. Learn more about the Verizon attack.

September 19, 2022

Rockstar Games

Video game publisher Rockstar Games experienced a data leak similar to the Uber hack below. Threat actors allegedly gained access to the company’s internal Slack messages and early code for their unannounced Grand Theft Auto video game sequel by gaining access to an employee’s login credentials. Read more about the Rockstar Games leak.

September 15, 2022

Uber

Uber fell victim to an MFA fatigue attack, which sends repeated sign-in approval notifications to an employee via SMS in hopes that endless notifications prompt them to complete the verification. The ride-sharing company attributes the attack to the cyber extortion group LAPSUS$. Discover how hackers found a way into Uber.

August 25, 2022

LastPass

LastPass experienced a security incident in which the threat actor gained access to its development environment for a 4-day period. It was contained immediately and no vault data or master passwords were compromised. Users were not asked to take any further action. In response to this incident, LastPass decommissioned the development environment and rebuilt it from scratch while further hardening developer machines, processes and authentication mechanisms. See the details of the Aug. 2022 LastPass breach.

August 10, 2022

Cisco

Cisco confirmed a breach of its corporate network where the attacker used voice phishing to convince an employee to accept MFA push notifications. They ultimately succeeded in gaining access to the company’s VPN and stealing an unspecified number of files from its network. Learn more about the Cisco breach.

August 7, 2022

Twilio

Twilio disclosed that hackers had accessed user data following 0ktapus, a sophisticated social engineering attack. Twilio identified 163 customers, including secure-communications provider Signal, whose data was accessed without authorization for a limited time. Read how Twilio customer data was exposed.

July 26, 2022

Okta

Group-IB analysts discovered that hackers targeted and stole 10,000 Okta user credentials and 5,441 MFA codes to carry out several sophisticated supply-chain attacks. Group-IB made its research on 0ktapus publicly available when Signal reported that 1,900 of their user accounts were hacked. Get the full details behind 0ktapus.

July 7, 2022

Marriott

Marriott suffered a data breach in its BWI Airport Marriott property near Baltimore. The hacker initiated a social engineering attack on a hotel staff member who unwittingly granted access to the property’s network, resulting in the theft of 300-400 customer credit card numbers. Read about Marriott’s recent security incident.

June 29, 2022

OpenSea

NFT giant OpenSea suffered a data breach after an employee of Customer.io, the company’s email delivery vendor, misused their privileged access to download and share email addresses of OpenSea’s 1.8 million users and newsletter subscribers with an unauthorized external party. Learn more about OpenSea phishing attack.

May 17, 2022

Costa Rica Government

Nearly 30 Costa Rican government institutions were hit in a wave of cyber attacks in May. The Russian-based hackers demanded $10 million which went unpaid. In response, the Conti ransomware group released 97% of 672 GB data. Read how Costa Rica was attacked.

April 12, 2022

GitHub

GitHub’s security team traced a breach to stolen OAuth user tokens issued to two third party integrators, Heroku and Travis-CI, to download data from private repositories belonging to dozens of organizations, including GitHub subsidiary npm. Attackers focused on exfiltrating PII to gain entry to other infrastructure and critical resources. Discover how GitHub repos were breached.

April 7, 2022

Cash App

Information of 8.2 million Cash App users was released by a former employee who accessed customer financial reports as an act of revenge against the company after their termination. A class action lawsuit was filed against the mobile payments company over “negligent” behavior. Read more about the Cash App attack.

April 4, 2022

Mailchimp

Mailchimp confirmed a data breach after malicious actors accessed an internal company tool used by the company’s customer support and account administration teams. After a successful social engineering attack, the hackers exported audience data, targeting customers in the cryptocurrency and finance sectors. Learn how hackers breached Mailchimp.

March 22, 2022

Microsoft

Microsoft confirmed that it was breached hours after LAPSUS$, a cyber extortion group, published a torrent file containing Bing, Bing Maps, and Cortana source code. Read how LAPSUS$ stole Microsoft source code.

March 18, 2022

HubSpot

HubSpot confirmed that over two dozen of its portals were subject to a data breach that compromised several of its clients’ data in the cryptocurrency space. Malicious actors compromised a Hubspot employee account used for customer support to extract contract details. This data breach affected companies like BlockFi, Swan Bitcoin, NYDIG, and Circle. Get details behind the HubSpot breach.

February 14, 2022

GiveSendGo

GiveSendGo was breached by politically motivated threat actors that released the personal information of 92,000 donors to the Freedom Convoy, an activist group of truck haulers based in Canada that protested COVID restrictions. The fundraising site was then redirected to another site that condemned the truckers — a case of a DDoS attack. Read more about the GiveSendGo attack.

February 4, 2022

News Corporation (News Corp)

Mass media and publishing giant News Corporation (News Corp) reported that it was the target of a persistent cyberattack that allowed an unauthorized third party to access personnel and journalists’ emails and business documents, which contained personal information. See how the WSJ and NY Post were attacked.

February 1, 2022

Oittaking and Mabanaft Group

German oil companies Oittaking and Mabanaft Group endured a cyberattack that threatened the gas supply of nearly 2,000 German Shell stations alone. Oittaking declared force majeure, which excuses the company from meeting contractual obligations in an extraordinary event that is beyond its control, for most of its supply activities. Read how Oittaking and Mabanaft Group operations were disrupted.

January 21, 2022

Okta

Okta experienced a breach by LAPSUS$, a cyber extortion group, which chose to publish a screenshot that establishes their alleged access. LAPSUS$ accessed two active customer tenants in the Okta environment and had control for 25 consecutive minutes. See the details on the Okta breach.

January 20, 2022

Crypto.com

Crypto.com admitted that hackers stole $36.45 million worth of cryptocurrency by bypassing its 2FA system. This incident led to the introduction of the company’s Worldwide Account Protection Program (WAPP) that would reimburse “qualifying users” in “select markets” with up to $250,000 after unauthorized withdrawals. Learn more about Crypto.com’s bitcoin and Ether heist.

January 18, 2022

International Committee of the Red Cross

The International Committee of the Red Cross (ICRC) experienced a breach that resulted in the data of more than 515,000 vulnerable people being compromised. The attack was highly targeted, using a piece of code that had been written purely to be executed on the ICRC’s servers. Read more on the Red Cross cyber attack.

January 6, 2022

FlexBooker

Online appointment company FlexBooker discovered a second data breach originating from its AWS account that exposed personal files belonging to 3.7 million users, which were distributed to the dark web. Get the details on FlexBooker’s data compromise.