TransUnion is a global consumer credit reporting agency, and one of the “Big Three” credit bureaus in the United States. In late August 2025, the company disclosed a data breach that began the previous month, affecting its U.S. consumer support operations. The incident, which TransUnion claims was quickly contained, did not compromise its core credit database or credit reports, but it exposed sensitive personal data. The breach is reportedly part of a wider campaign of attacks targeting companies that use Salesforce, a third-party cloud-based service, by a well-known hacking group.

Ai Execs May Be Too Out Of Touch To Build For The General Public

Marriott also fired most of Starwoods’ IT staff, which left few IT professionals to monitor the Starwoods data. Despite the announcement occurring in 2016, the breach may have occurred as early as 2008, with the last confirmed date breach confirmed to have taken place in 2013. This is important because unlike many of the other companies on this list, MySpace responded swiftly to the discovery and invalidated all passwords created prior to 2013. While it wasn’t a perfect solution, annoying many users, it did allow MySpace to protect many of those affected by the breach. In contrast, a privacy breach is any unauthorized handling of personal information, whether or not a security failure is involved.

There was no message content, but metadata at this scale reveals social graphs, patterns of life, and, via cell site identifiers, approximate movements, which is why privacy advocates treated it as more sensitive than a conventional contact list leak. AT&T also reportedly paid a hacker around 370,000 dollars to delete the data, one of the few publicly documented deletion payments by a major US carrier. Researcher Bob Diachenko found a 150-gigabyte MongoDB database belonging to the email validation service Verifications.io sitting open on the internet.

The Tribune of India reported that its reporters paid 500 rupees to anonymous sellers on WhatsApp and received working credentials that let them query the Aadhaar database for any of the roughly 1.1 billion enrolled residents. The World Economic Forum’s 2019 Global Risks Report cited it as the largest breach of its kind. The list runs from the largest exposed datasets ever documented down to smaller but landmark incidents.

The real power comes from knowing how to protect yourself from potentially disastrous effects after a data breach and having the right tools to support you. In the end, the breach directly affected 14,000 user accounts, but led to nearly 7 million indirect exposures due to shared data that was part of the 23andMe’s DNA Relatives sharing feature. The company later settled a class-action lawsuit in the U.S. for $30 million, while offering identity monitoring and stronger authentication going forward. Even if your details are not stolen in the data breach, the criminals will exploit high profile breaches (whilst they are still fresh in people’s minds) to try and trick people into clicking on scam messages.

In May 2025, Ascension disclosed a significant data breach involving third-party vendors, exposing sensitive patient information ideal for medical identity theft. The breach, primarily linked to a former business partner’s outdated software and a compromised cloud system, highlighted vulnerabilities in vendor security practices, impacting hundreds of thousands of individuals. In July 2025, Allianz Life Insurance Company of North America, a major provider of retirement and financial solutions and a subsidiary of the global financial services giant Allianz SE, confirmed a substantial data breach. The incident did not involve a direct attack on the company’s internal systems, but rather on a third-party, cloud-based Customer Relationship Management (CRM) system used by the company. The breach was a prime example of a supply chain attack, where a weakness in a vendor’s security led to the exposure of a vast amount of sensitive customer information, highlighting the critical importance of vetting third-party partners.

Hundreds of thousands of customers were likely affected, though exact numbers remain unconfirmed. The company’s global operations were disrupted for several days, with a significant financial impact estimated at over $136 million per day. The data of all 6.5 million members of the Co-op’s loyalty program was compromised in the incident.

What Are Companies Doing About Data Breaches?

The through line across four decades of incidents is that scale rarely comes from sophistication. That shifts the defensive priority from your own perimeter to the security posture of every vendor, contractor, and connected application you rely on. Continuous visibility into third-party exposure, not a once-a-year questionnaire, is what helps you prevent data breaches of the kind that fill this list. Attackers broke into roughly 14,000 accounts using recycled passwords and then leveraged the DNA Relatives feature to harvest profile data on 6.9 million people who had never had their own accounts compromised. Datasets specifically targeting people of Ashkenazi Jewish and Chinese descent were advertised for sale, which turned the incident into an ethnic targeting concern rather than a conventional identity theft case. 23andMe initially blamed customers for password reuse and changed its terms of service to restrict class actions, both of which drew heavy criticism.

The attackers gained access using credentials that had been stolen back in 2021, after an employee of a Samsung partner was infected with malware. Security firm Hudson Rock had alerted Samsung to the leaked credentials years earlier. They remained active for years and ultimately enabled the successful attack in 2025. The leak included names, email addresses, phone numbers, order numbers, and product details (e.g., TV models) as well as customer complaints and Samsung’s responses.

What Penalties Do Companies Face For Serious Data Protection Violations?

This group, which operates using a ransomware-as-a-service (RaaS) model, gained unauthorized access to Orange’s systems and stole data before encrypting some of the company’s files. Air France and KLM, part of the Air France–KLM Group, are major European airlines that serve a vast global network. On August 7, 2025, the airlines disclosed a data breach that originated from a third-party customer support platform they use. The breach exposed the data of a limited number of Google’s business customers. While Google stated that no consumer passwords or financial data were compromised, the company issued a warning to its 2.5 billion Gmail users due to the potential for targeted follow-up attacks. December data breaches included retail, education, pharma, and a streaming platform.

In 2023, DNA testing company 23andMe came under fire after hackers leaked and sold detailed genetic information along with identity data. The incident became public after excerpts of the stolen data were offered for sale on dark web forums. The data included names, contact details, genetic profiles, and ancestry information. California Cryobank (CCB), a company specializing in sperm and egg donation services, experienced a data breach in March 2025, revealing unauthorized access to customer data from April 2024.

The attack resulted in files containing bank account numbers and statements, mortgage records, photos of driver’s licenses, Social Security numbers, tax documents, and wire transfer receipts dating back to 2003 digitized and made available online. A common form of security incident is the loss of devices or unauthorized access to credentials, resulting in cyber criminals obtaining confidential information. For example, a lost laptop, mobile phone, or external hard drive that is unlocked or unencrypted can easily lead to information being stolen if it ends up in the wrong hands. An information breach can have highly damaging effects on businesses, not only through financial losses but also the reputation damage it causes with customers, clients, and employees. Conduent, a major business process amoredate.org/ outsourcing and IT services provider experienced a significant cybersecurity incident in January 2025. This incident caused disruptions to services across multiple states, particularly affecting government agencies and their ability to process payments and provide essential services.

• Researcher Bob Diachenko found a 150-gigabyte MongoDB database belonging to the email validation service Verifications.io sitting open on the internet.
• While MySpace no longer has the same global influence that it once did, its legacy is felt through other social media platforms and for having one of the worst privacy breaches in internet history.
• Had Marriott International done so, they would have avoided one of the biggest data breaches of all time.
• For example, the average cost of a data breach in the United States is USD 11.5 million, about 4 times the cost of a breach in India (USD 2.79 million).
• 70+ data privacy statistics for 2026, covering consumer trust, AI risk, breach costs, fines, and cookie consent.

Bryan Cave provides Mondelez and a number of other large companies with legal services. According to the data breach notice filed to the Maine Attorney General’s Office, employees are thought to have been affected. Although the data breach occurred in February of this year, it was only discovered three months later in May, the filing reveals.

When your company is in the process of being bought out, the last thing you want the FTC to scrutinize you over is your improper sensitive data handling. For Yahoo, that is exactly what happened in 2016 as they were being acquired by Verizon Communications. Some companies and organizations have had to shut down due to the fallout costs of a cyberattack. There has never been more of an onus on companies, colleges, and other types of organizations to protect themselves. India’s opposition parties are asking the government to urgently launch a probe into the breach and create a working data security plan for government agencies and departments. Customer names and some information about their current Anthropic balances were the only types of information leaked in the incident, and customers impacted by the mistake have been notified.

The exposure effectively covered the entire adult population of Brazil, including deceased individuals, and arrived just as Brazil’s data protection law was becoming enforceable. KrebsOnSecurity revealed that First American, the second largest title insurer in the United States, had been publishing hundreds of millions of scanned real estate closing documents on its website in a way that required no login at all. Changing a single digit in a document URL returned somebody else’s financial paperwork. The flaw required no attacker sophistication, which is precisely why the case is cited so often, and the exposure ran for roughly 16 years before an outside journalist reported it. In August, a similar fate befell medical device maker Boston Scientific, after a cyberattack cut off the company’s global network, causing a “global disruption” to its operations.

Country-specific roundups, including our list of the biggest data breaches in France, track regional incidents in more depth. The group returned roughly two weeks later through a second vulnerability and defaced Canvas login pages at universities across the country, including Harvard, Columbia, Princeton, and Georgetown, with ransom messages. Access was disrupted during final exams, which is why the incident is widely regarded as the largest and most damaging education sector breach on record even though the 275 million figure remains unverified.

But the disruption alone was likely to affect the company’s financials, and it was forced to delay filing its quarterly report with the SEC, as it scrambled to handle the incident. The incident affected tens of thousands of accounts before the improper access was discovered and cut off. It was an embarrassing and high-profile lapse in security — and trust — for one of the world’s largest tech companies. Now, thanks to the recent war waged by the U.S. and Israel against Iran, hackers working for the Iranian regime are actively hacking critical infrastructure across the United States in opportunistic attempts to disrupt neighborhoods and communities. The breach caused a countrywide outage of the PetroCanada mobile app, web accounts, payment gateways, and internal systems.

Crucially, Louis Vuitton has confirmed that no payment information, credit card details, or passwords were leaked. The stolen data included names, addresses, and other contact information, although the company has stated that no financial details, passwords, or transaction history were accessed. Orange SA, formerly France Télécom, is a French multinational telecommunications corporation and a major global player in mobile, fixed-line, internet, and IPTV services. In early August 2025, the company was targeted by a ransomware attack by the Warlock ransomware group, resulting in the theft and publication of sensitive business data on the dark web. Orange confirmed the data release, stating the threat actor had only limited access to its systems and the stolen information was outdated or of low sensitivity. The compromised data was highly sensitive, including member names, account numbers, debit card information, Social Security numbers, and other government IDs.

The organization began notifying affected individuals in June 2025, with the investigation into compromised files having concluded the month prior. The exact number of affected customers has not been officially disclosed by the airlines, but reports indicate it could impact hundreds of thousands of travelers who had previously interacted with the customer service platform. The cause was determined to be an insider breach, where a former employee improperly accessed and exported sensitive data over a period of two years.

This month’s data breach report reveals a series of alarming incidents, each highlighting the vulnerabilities inherent in our increasingly interconnected digital landscape. May 2025 was another alarming month for cybersecurity, with a surge in high-impact data breaches affecting major organizations across industries—from finance and retail to healthcare and technology. This month’s breaches underscored recurring vulnerabilities tied to third-party vendors, insider threats, and outdated software systems. Notably, Coinbase faced a major extortion attempt linked to overseas support contractors, while Marks & Spencer suffered severe disruptions from a ransomware attack believed to be connected to IT outsourcing.