5 Massive Security Breaches That Rocked The World In 2018

2018 has proven that security breaches advance with technology. Cybercriminals are finding more clever and dangerous ways of getting access to systems and user data illegally. Some are allegedly state-sponsored, while others are borne out of individuals with ill-intentions towards the targets’ privacy. In this article, we’ll analyse five security breaches that rocked the world in 2018.

US University Breach

The Department of Justice indicted nine Iranian cybercriminals in March of 2018 for allegedly hacking into the databases of universities in America using a SamSam ransomware. The hackers used a spearphishing technique that tricked university professors and other affiliates into clicking on malicious links in order to enter their login credentials. They succeeded in getting access to data of 3,768 out of the 8,000 people they targeted.

The authorities say cybercriminals infiltrated 144 American universities, 176 universities in 21 other countries, the United Nations, the states of Hawaii and Indiana. In all, the hackers stole 31 terabytes of data containing $3 billion worth of intellectual property. The US DoJ says the perpetrators of the act could be affiliated to the Mabna Institute, a hacker clearinghouse in Tehran, Iran.

Under Armour, Under Attack

Sports apparel manufacturer, Under Armour, was hit by cybercriminals in February 2018. Hackers breached the company’s MyFitnessPal app, compromising the data of close to 150 million users. The cybercriminals accessed usernames, emails, and passwords. Under Armour discovered the intrusion on March 25, and notified the public within the next week.

The company had been using bcrypt, a robust set of encryption security protocols to protect the passwords of its users. The company was hashing passwords of its users or converting them into a string of unintelligible characters, making them safe from breaches.

So how did the hackers get in? Well, it turns out Under Armour had employed bcrypt for only a select group of customers. Many others had their passwords protected using a less secure SHA-1. These damning revelations notwithstanding, it seemed Under Armour’s security protocols protected other key information like credit card details, location, and birth dates from the cybercriminals.

Facebook Hacker Haven

Facebook has been in a lot of trouble since the 2016 US presidential elections. Following the Cambridge Analytica revelations, news emerged late 2018 that a security breach had given cybercriminals access to data of between 50 and 90 million Facebook users. The situation, perpetuated through stealing user access tokens, was discovered on September 25 and the patch resolved a couple of days later. But the consequences were dire.

When you log into your Facebook account, a security key ensures you remain logged in during multiple sessions without having to log into the system again. By stealing this key, hackers had the ability to log into your account and, if they wanted to, use your account for other dubious activities or just kick you out.

According to Facebook’s admission, cybercriminals were able to get access to this token by exploiting a bug in the “view as” feature of Facebook profiles. The feature allows you to view your profile as any other person would without logging out of your account. To resolve the situation, Facebook logged 50 million users out of their accounts and asked them to log in again. It also asked 40 million additional users to do the same thing in order to stay safe.

Google+ Gets a Minus

Google+ had suffered a security breach for months before the situation came to light. The parent company had hidden the news from the pubic in a bid to avoid a potential regulatory sanction, some say.

A bug in their API had given third-party access to Google+ user information. Not just that, but the app developers also had the opportunity to access data of people on users’ friends lists. That made the security breach potentially bigger than first. However, Google said the breach affected 500,000 accounts through the actions of up to 438 applications.

To stem the influence of the cybercriminals, Google+ closed shop. The social network site shut down consumer access to the platform while working to improve privacy protection for third-party apps. Google+ maintained only two weeks of API log, meaning it could not ascertain whether or not the app developers actually managed to access user data. Due to the supposed level of the potential damage, however, Google was not under obligation to disclose the breach.

Quora

Knowledge-sharing website, Quora, suffered a major security breach in November 2018. Cybercriminals were able to access data of up to 100 million users, including information on email addresses, IP addresses, encrypted passwords, user IDs and account settings, among others. The security breach meant hackers could have access to every single decision taken by users, including questions they had asked or responded to as well as messages they had sent out to other users.

The security breach happened when malicious users gained access to one of Quroa’s systems. Anonymous users, however, were safe because Quora doesn’t store identification data of such users.

Conclusion

While enterprises are taking bold steps to protect your data, there are unscrupulous cybercriminals working hard to compromise the system. As an internet user, you should not leave anything to chance. Don’t download apps whose security settings are low just in the name of convenience. And when you hear that big companies have been hit by cybercriminals, quickly reset your login credentials and wait till the issue is rectified before using it again. Be careful about using public hotspots and make sure you use double factor authentication on your accounts where available.

Stay safe!