The previous year will mark one of the most destructive ones for global cybersecurity. Hackers targeted industries at all levels of the spectrum: healthcare, telecom, defense and even entertainment. In unprecedented sophistication, hackers exploited weaknesses in these places. These hacks not only showed sensitive data, but also showed the world what it needs: a stronger cybersecurity framework.
The year opened with a seismic breach impacting both social media platforms and financial institutions. Dubbed the "Mother of All Breaches," the attack exposed billions of personal records. The root cause? A firewall failure at Leak Lookup, a data leak search engine.
Lessons learned:
Hackers stole 2.9 billion records from a company called National Public Data, a background check service. It has full names, addresses and Social Security numbers, mostly of people who do not know that this company had even collected information from them. The cause of this may be due to weak encryption, according to some critics.
Lessons learned:
A ransomware attack on Change Healthcare shut down medical services across the country, impacting 100 million users. The hackers were identified as the BlackCat group, who took advantage of the fact that multi-factor authentication was not enabled on employee systems.
Lessons learned:
AT&T had two significant data breaches in 2024. The first had the information of 73 million account holders, and the second had nearly all its customers, which adds up to 110 million. Hackers accessed the data using third-party platforms, which includes Snowflake.
Lessons learned:
A North Korean cell infiltrated the United States through fake remote worker profiles. Utilizing phony identities and hacked corporate laptops, the North Koreans laundered money for the North Korean nuclear program.
Lessons learned:
Hackers accessed 560 million customer records by breaching Ticketmaster, exploiting third-party integration vulnerabilities. The hackers affiliated with the ShinyHunters group hacked into customers' payment data and access credentials.
Lessons learned:
Qilin ransomware attackers have stolen information from Synnovis, a U.K. pathology lab, containing sensitive patient information including test results for cancer and HIV. This attack affected over 300 million records and is the latest attack on the healthcare industry.
Lessons learned:
The breach of the payroll system at the U.K. Ministry of Defence exposed sensitive personal data relating to military staff. The third-party contractor managing the payroll had exploited vulnerabilities within its system.
Lessons learned:
A cyberattack on CDK Global halted business operations for thousands of car dealerships in North America. The attack showed how poor employee education and security policies can cause devastating problems.
Lessons learned:
The breaches this year highlighted a worrying reality: no organization is immune to cyberattacks. As we enter 2025, it is imperative for businesses to adopt proactive measures-from strengthening encryption and implementing MFA to training employees and securing third-party integrations. By learning from these incidents, organizations can bolster their defenses and mitigate the risks of future attacks.