All SaaS Breaches

2023

April 3, 2023

Capita

London-based professional services firm Capita reported a cyber incident affecting access to its internal Microsoft 365 apps. The event led to service disruptions with an undisclosed number of clients. At this time, Capita does not believe customer, supplier, or employee data has been compromised. See more about the Capita incident.

March 29, 2023

Toyota Italy

Toyota Italy accidentally leaked sensitive marketing data for more than a year. This included exposed credentials to its Salesforce Marketing Cloud and Mapbox’s API tokens. Read more details about the data leak.

March 24, 2023

ChatGPT

OpenAI was forced to take ChatGPT offline after a user exploited an open-source library bug. That same bug may have exposed the personal data and chat queries of 1.2% of ChatGPT Plus subscribers who were active during the nine-hour window before ChatGPT went offline. Dive into ChatGPT’s first major breach.

March 20, 2023

Ferrari

Ferrari confirmed a ransomware attack was responsible for a data breach that exposed customer details including names, addresses, emails, and phone numbers. No payment information or details of Ferrari cars owned or ordered had been stolen. Discover more about the Ferrari ransomware attack.

March 16, 2023

AT&T

AT&T notified 9 million customers that their customer proprietary network information (CPNI) was compromised due to a third party vendor breach. Exposed data includes first names, wireless account numbers, wireless phone numbers and email addresses. Read more about the AT&T breach.

March 9, 2023

DC Health Link

DC Health Link, the health insurance marketplace for the District of Columbia, confirmed a breach exposing the personal data of 56,000 members, including staff of the U.S. House of Representatives. The original attack vector was an open, exposed database and hacker was able to connect to the database software without verification. Get the details of the DC Health Link breach.

March 2, 2023

The U.S. Federal Reserve

The U.S. Federal Reserve canceled a Zoom video conference after it was hijacked by a participant who displayed pornographic images. This was likely the result of improper security configuration of guest access and user permissions. Learn more about the Zoom porn bombing incident.

February 27, 2023

LastPass

LastPass confirmed that the same attacker from previous breaches stole valid credentials from a senior DevOps engineer, targeted their home computer, and exploited a vulnerable third party media software package. This enabled remote code execution and keylogger malware to be implanted. Attackers achieved access to the company data vault and decryption keys, exfiltrating customer vault backups stored in AWS S3 buckets. Get the full scope of this LastPass breach.

February 21, 2023

Activision

Hackers stole Activision’s content roadmap for Call of Duty and employee data by infiltrating the company’s Slack channel through an SMS phishing scheme. The targeted employee, part of the HR department, had access to sensitive staff data. Read how threat actors breached Activision.

February 17, 2023

U.S. Marshals Service

The U.S. Marshals Service suffered a ransomware security breach that compromised PII of fugitives, staff, and third parties. Federal agencies are required to report major incidents to Congress within seven days of identification. See how Marshal Service was attacked.

February 10, 2023

Pepsi Bottling Ventures

Pepsi Bottling Ventures discovered a data breach that included Social Security numbers and login credentials. It’s unclear whether the stolen data pertains to customers or employees — and if PepsiCo was also affected. Dive into the PBV breach specifics.

January 19, 2023

PayPal

PayPal reported a credential-stuffing attack, in which hackers leveraged username and password pairs sourced from previous data leaks. The company detected and mitigated the attack, but the hackers may have exfiltrated some sensitive data from the 35,000 compromised accounts. Discover the PayPal attack details.

January 7, 2023

CircleCI

CircleCI confirmed a data breach that stemmed from an employee’s laptop becoming infected with malware. The threat actor stole a valid MFA SSO session, allowing exfiltration of data that included customer environment variables, tokens, and keys. CircleCI’s antivirus software did not detect the malware. Learn how the CircleCI breach happened — and how to prevent similar attacks.

January 4, 2023

Twitter

A database of over 200 million Twitter users went public, originally scraped by exploiting an API vulnerability that was previously exposed from June 2021 to January 2022. Get the Twitter data leak details.

2022

December 31, 2022

Slack

Slack experienced a cyberattack where a limited number of employee tokens was stolen to gain access to the company’s externally hosted GitHub repository and private source code. Learn the details behind the Slack attack.

December 22, 2022

LastPass

LastPass released an updated statement confirming that customers’ 256 bit AES encrypted password data had been looted. The hacker was also able to copy a backup of customer vault data that includes both unencrypted data, encrypted fields like usernames and passwords, and form-filled data. Read how LastPass attackers accessed password vaults.

November 30, 2022

LastPass

LastPass notified its customers that an unauthorized party had accessed certain elements of customers’ information within a third party cloud storage service shared with GoTo (formerly LogMeIn). See how the Aug. 2022 hacking incident allowed exfiltration of encrypted customer data.

November 1, 2022

Dropbox

Dropbox suffered a data breach of their internal GitHub code repositories that included API keys. Dropbox employees were targeted with phishing emails that led them to an imitation CircleCI login page and also prompted them to enter a One-Time Password (OTP). Learn how the Dropbox attacker accessed a GitHub repo.

October 28, 2022

Twilio

Twilio disclosed a second breach by 0ktapus hackers where an employee was socially engineered through voice phishing (vishing). The Twilio employee provided their corporate credentials, enabling the attacker to access customer contact information for a “limited number” of customers. Read about Twilio’s second 0ktapus incident.

October 18, 2022

Verizon

Verizon alerted customers of a cyberattack that granted third party actors access to their accounts. The breach exposed the last four digits of customers’ credit cards to make payments on their prepaid accounts, and potentially enabled attackers to process unauthorized SIM card changes on prepaid lines. Learn more about the Verizon attack.

September 19, 2022

Rockstar Games

Video game publisher Rockstar Games experienced a data leak similar to the Uber hack below. Threat actors allegedly gained access to the company’s internal Slack messages and early code for their unannounced Grand Theft Auto video game sequel by gaining access to an employee’s login credentials. Read more about the Rockstar Games leak.

September 15, 2022

Uber

Uber fell victim to an MFA fatigue attack, which sends repeated sign-in approval notifications to an employee via SMS in hopes that endless notifications prompt them to complete the verification. The ride-sharing company attributes the attack to the cyber extortion group LAPSUS$. Discover how hackers found a way into Uber.

August 25, 2022

LastPass

LastPass experienced a security incident in which the threat actor gained access to its development environment for a 4-day period. It was contained immediately and no vault data or master passwords were compromised. Users were not asked to take any further action. In response to this incident, LastPass decommissioned the development environment and rebuilt it from scratch while further hardening developer machines, processes and authentication mechanisms. See the details of the Aug. 2022 LastPass breach.

August 10, 2022

Cisco

Cisco confirmed a breach of its corporate network where the attacker used voice phishing to convince an employee to accept MFA push notifications. They ultimately succeeded in gaining access to the company’s VPN and stealing an unspecified number of files from its network. Learn more about the Cisco breach.

August 7, 2022

Twilio

Twilio disclosed that hackers had accessed user data following 0ktapus, a sophisticated social engineering attack. Twilio identified 163 customers, including secure-communications provider Signal, whose data was accessed without authorization for a limited time. Read how Twilio customer data was exposed.

July 26, 2022

Okta

Group-IB analysts discovered that hackers targeted and stole 10,000 Okta user credentials and 5,441 MFA codes to carry out several sophisticated supply-chain attacks. Group-IB made its research on 0ktapus publicly available when Signal reported that 1,900 of their user accounts were hacked. Get the full details behind 0ktapus.

July 7, 2022

Marriott

Marriott suffered a data breach in its BWI Airport Marriott property near Baltimore. The hacker initiated a social engineering attack on a hotel staff member who unwittingly granted access to the property’s network, resulting in the theft of 300-400 customer credit card numbers. Read about Marriott’s recent security incident.

June 29, 2022

OpenSea

NFT giant OpenSea suffered a data breach after an employee of Customer.io, the company’s email delivery vendor, misused their privileged access to download and share email addresses of OpenSea’s 1.8 million users and newsletter subscribers with an unauthorized external party. Learn more about OpenSea phishing attack.

May 17, 2022

Costa Rica Government

Nearly 30 Costa Rican government institutions were hit in a wave of cyber attacks in May. The Russian-based hackers demanded $10 million which went unpaid. In response, the Conti ransomware group released 97% of 672 GB data. Read how Costa Rica was attacked.

April 12, 2022

GitHub

GitHub’s security team traced a breach to stolen OAuth user tokens issued to two third party integrators, Heroku and Travis-CI, to download data from private repositories belonging to dozens of organizations, including GitHub subsidiary npm. Attackers focused on exfiltrating PII to gain entry to other infrastructure and critical resources. Discover how GitHub repos were breached.

April 7, 2022

Cash App

Information of 8.2 million Cash App users was released by a former employee who accessed customer financial reports as an act of revenge against the company after their termination. A class action lawsuit was filed against the mobile payments company over “negligent” behavior. Read more about the Cash App attack.

April 4, 2022

Mailchimp

Mailchimp confirmed a data breach after malicious actors accessed an internal company tool used by the company’s customer support and account administration teams. After a successful social engineering attack, the hackers exported audience data, targeting customers in the cryptocurrency and finance sectors. Learn how hackers breached Mailchimp.

March 22, 2022

Microsoft

Microsoft confirmed that it was breached hours after LAPSUS$, a cyber extortion group, published a torrent file containing Bing, Bing Maps, and Cortana source code. Read how LAPSUS$ stole Microsoft source code.

March 18, 2022

HubSpot

HubSpot confirmed that over two dozen of its portals were subject to a data breach that compromised several of its clients’ data in the cryptocurrency space. Malicious actors compromised a Hubspot employee account used for customer support to extract contract details. This data breach affected companies like BlockFi, Swan Bitcoin, NYDIG, and Circle. Get details behind the HubSpot breach.

February 14, 2022

GiveSendGo

GiveSendGo was breached by politically motivated threat actors that released the personal information of 92,000 donors to the Freedom Convoy, an activist group of truck haulers based in Canada that protested COVID restrictions. The fundraising site was then redirected to another site that condemned the truckers — a case of a DDoS attack. Read more about the GiveSendGo attack.

February 4, 2022

News Corporation (News Corp)

Mass media and publishing giant News Corporation (News Corp) reported that it was the target of a persistent cyberattack that allowed an unauthorized third party to access personnel and journalists’ emails and business documents, which contained personal information. See how the WSJ and NY Post were attacked.

February 1, 2022

Oittaking and Mabanaft Group

German oil companies Oittaking and Mabanaft Group endured a cyberattack that threatened the gas supply of nearly 2,000 German Shell stations alone. Oittaking declared force majeure, which excuses the company from meeting contractual obligations in an extraordinary event that is beyond its control, for most of its supply activities. Read how Oittaking and Mabanaft Group operations were disrupted.

January 21, 2022

Okta

Okta experienced a breach by LAPSUS$, a cyber extortion group, which chose to publish a screenshot that establishes their alleged access. LAPSUS$ accessed two active customer tenants in the Okta environment and had control for 25 consecutive minutes. See the details on the Okta breach.

January 20, 2022

Crypto.com

Crypto.com admitted that hackers stole $36.45 million worth of cryptocurrency by bypassing its 2FA system. This incident led to the introduction of the company’s Worldwide Account Protection Program (WAPP) that would reimburse “qualifying users” in “select markets” with up to $250,000 after unauthorized withdrawals. Learn more about Crypto.com’s bitcoin and Ether heist.

January 18, 2022

International Committee of the Red Cross

The International Committee of the Red Cross (ICRC) experienced a breach that resulted in the data of more than 515,000 vulnerable people being compromised. The attack was highly targeted, using a piece of code that had been written purely to be executed on the ICRC’s servers. Read more on the Red Cross cyber attack.

January 6, 2022

FlexBooker

Online appointment company FlexBooker discovered a second data breach originating from its AWS account that exposed personal files belonging to 3.7 million users, which were distributed to the dark web. Get the details on FlexBooker’s data compromise.