In the past few years we have witnessed a growing number of significant data breaches.
The Data Breach Epidemic Report reviews the most significant data breaches that occurred in 2018 and provides our analysis of the major data leaks. It also includes key trends we identified based on ~5B leaked records detected and analyzed by our team.
4,812,840,627 – Total Leaked Records In 2018
1,925,136,251 – Unique Records
24,224,940 – Organizations
53% of all leaked data comes from .com domains
Distribution of “Combo Lists” is the key trend in the 2018 data leaks
Leaked records by region:
APAC – 1.5B records
EMEA – 728M records
LATAM – 34M records
THE ANALYSIS PROCESS
In order to identify and analyze the major breaches of 2018, our analysts have been continuously monitoring activities on the Dark Web, in closed hacking communities and in other sources, to uncover indicators of breaches and data leaks.
In the report you will find a summary of the most popular ways hackers use to exploit stolen data, with real-life examples of attacks that exploited leaked records.
Based on our analysis of the leaked data we obtained from several underground sources, we were able to identify several key trends, for example, the increasing distribution of “Combo Lists”, the demand for region specific leaks and countries that had most government data leaked.
ANALYSIS OF EXPLOITATION METHODS
The report also shares the hackers’ perspective, reviewing the most popular ways hackers use to exploit leaked data. These include credential stuffing attacks, brute force attacks, social engineering and email based-attacks. This information is valuable as it can really help organizations prioritize risk and improve their resilience and readiness against these attack methods.
THE BIGGEST DATA BREACHES OF 2018
In the report, you will find the list of the most prominent data breaches that occurred in 2018, and what we can learn from the millions of compromised records and stolen data.
The political tension after the Catalonia referendum on October 1, 2017, has influenced the virtual arena as well, resulting in cyber-attacks against Spanish websites carried out by hacktivists leaking information about high profile targets and claiming responsibility for shutting down websites. These threat actors use various anti-Spain hashtags that indicate the different cyber campaigns: #OpEspana, #OpCatalonia, #OpCatalonya and #OpSaveCatalonia. Continue reading “Political Tension in Spain Leads to Cyber-Attacks against Spanish Websites”
Hacktivists recently launched the fifth phase of the #OpIcarus cyber campaign (also dubbed #OpSacred) against the financial sector around the world. This campaign was first launched in February 2016, and as in previous phases, the official target list contains mainly websites of central banks around the world. In addition, the initiators share links to download known DDoS tools, such as Continue reading “#OpIcarus Cyber Campaign – Round 5”
The number of participants in the event pages of the #OpIsrael campaign, as of the first week of April 2017, is approximately 600 Facebook users – a very low number of supporters compared to the same period in previous campaigns. In general, the response on social networks to the #OpIsrael campaign over the years since 2013 is constantly declining. Continue reading “Updates about the Upcoming #OpIsrael Campaign”
During the past week, we detected indications for initial preparations for the upcoming #OpIsrael campaign scheduled for April 7, 2017. SenseCy identified several event pages on Facebook that were opened explicitly to organize cyber-attacks. The number of participants in all the event pages that we found is relatively low (approximately 160 Facebook users). Continue reading “Initial Preparations for #OpIsrael 2017”
2016 has witnessed an exponential growth in data breach incidents. These incidents led to the compromise of various user details, including email addresses, passwords, usernames, full names, phone numbers and much more. These login credentials, which in many cases were reused on multiple platforms and services, were stolen from social network websites, such as LinkedIn, Tumblr, VK, gaming platforms, adult content websites, and Continue reading “The Life Cycle of a Data Breach”