The Biggest Data Breaches of 2023

Last modified: November 27, 2023

BREACHES

0 B

RECORDS LEAKED

BREACHES

0 B

RECORDS LEAKED

Follow me on Twitter

Connect on Linkedin

Connect on Mastodon

Similarly to what I have done in 2022 and 2021, I am collecting the main mega breaches (that is breaches with more than one million records stolen by the attackers and possibly leaked). The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.

For the sake of readability, the size of the bubbles in the corresponding diagram are in logarithmic scale.

Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Geo	Link	Tags	Records Raw	Records
04/01/2023	During 2021	During November 2022	StayMad	Twitter	A threat actor released a data set consisting of 200 million Twitter profiles for approximately $2.	API vulnerability	Information and communication	Cyber Crime	US		StayMad, Twitter	200,00	200.000.000,00
10/01/2023	-	9/1/2023	?	Undisclosed marketing provider in Japan	The Japanese customers of two large insurance companies, Aflac and Zurich, have their personal information leaked after the breach of a third-party service provider. it is unclear if the breaches are related and the service provider is the same.	Vulnerability in a file transfer server	Finance and insurance	Cyber Crime	JP		Aflac, Zurich	2,10	2.100.000,00
19/01/2023	Since 25/11/2022	5/1/2023	?	T-Mobile	T-Mobile discloses a new data breach after a threat actor stole the personal information of 37 million current postpaid and prepaid customer accounts through one of its Application Programming Interfaces (APIs).	API Vulnerability	Information and communication	Cyber Crime	US		T-Mobile	37,00	37.000.000,00
24/01/2023	-	24/1/2023	?	DuoLingo	Language learning platform DuoLingo says it is investigating a post on a hacking forum offering information on 2.6 million customer accounts for $1,500.	Misconfiguration	Education	Cyber Crime	US		DuoLingo	2,60	2.600.000,00
30/01/2023	.	26/1/2023	?	CommuteAir	A U.S. No Fly list with over 1.5 million records of banned flyers and upwards of 250,000 'selectees' is shared publicly on a hacking forum.	Misconfiguration	Transportation and storage	Cyber Crime	US		CommuteAir	1,75	1.750.000,00
01/02/2023	01/12/2022	08/12/2022	?	Heritage Provider Network	Multiple medical groups in the Heritage Provider Network in California suffer a ransomware attack, exposing sensitive patient information to cybercriminals.	Malware	Human health and social work	Cyber Crime	US		Heritage Provider Network, ransomware, Regal Medical Group, Lakeside Medical Organization, A Medical Group, ADOC Acquisition Co ,A Medical Group Inc. & Greater Covina Medical Group	3,30	3.300.000,00
03/02/2023	-	21/02/2023	?	PeopleConnect	PeopleConnect, the owners of the TruthFinder and Instant Checkmate background check services, confirm they suffered a data breach after hackers leaked a 2019 backup database containing the info of 20 millions of customers.	Inadvertent leak	Professional, scientific and technical	Cyber Crime	US		PeopleConnect, TruthFinder, Instant Checkmate	20,00	20.000.000,00
08/02/2023	During February 2023	06/02/2023	IntelBroker	Weee!	The Weee! Asian and Hispanic food delivery service suffers a data breach exposing the personal information of 1.1 million customers.	Unknown	Accomodation and food service	Cyber Crime	US		Weee!	1,10	1.100.000,00
10/02/2023	-	06/01/2023	IntelBroker	AT&T	A threat actor named IntelBroker claims to have found a third-party vendor’s unsecured cloud storage containing 37 million AT&T client records. The threat actor shares a sample of 5 million records.	Misconfiguration	Information and communication	Cyber Crime	US		IntelBroker, AT&T	37,00	37.000.000,00
10/02/2023	-	27/01/2023	IntelBroker	Verizon	IntelBroker leaks a database, allegedly from Verizon, for free, containing 7.5 million clients’ records, only first names, device types (Apple or Android), and service plans. Verizon verified that the data leak was legitimate and originated from a vendor which creates videos to assist clients.	Unknown	Information and communication	Cyber Crime	US		IntelBroker, Verizon	7,50	7.500.000,00
13/02/2023	-	-	?	Community Health Systems	Community Health Systems estimates that 1 million patients have been impacted by the GoAnywhere breach.	CVE-2023-0669 Vulnerability	Human health and social work	Cyber Crime	US		Community Health Systems, GoAnywhere, CVE-2023-0669	1,10	1.100.000,00
16/02/2023	Between 28/10/2021 and 31/10/2021	-	?	MySejahtera	The personal information of three millions of MySejahtera users is exposed after an account authorised for vaccine administration stole data from three million vaccine recipients.	Account Takeover	Human health and social work	Cyber Crime	MY		MySejahtera	3,00	3.000.000,00
20/02/2023	During December 2022	20/02/2023	UNIT82	RailYatri	RailYatri, a popular Indian train ticket booking platform, suffers a massive data breach that exposes the personal information of over 31 million (31,062,673) users/travellers.	Unknown	Transportation and storage	Cyber Crime	IN		RailYatri, UNIT82	31,00	31.000.000,00
01/03/2023	28/02/2023	28/02/2023	?	Unknown target(s)	Researchers from Cyble reveal that the carding marketplace known as BidenCash has leaked online a free database of 2,165,700 debit and credit cards in celebration of its first anniversary.	Unknown	Finance and insurance	Cyber Crime	>1		Cyble, BidenCash	2,17	2.165.700,00
06/03/2023	During Januay 2023	-	?	Undisclosed marketing vendor	AT&T notifies roughly 9 million customers that some of their information was exposed after a marketing vendor was hacked in January.	Unknown	Administration and support service	Cyber Crime	US		AT&T	9,00	9.000.000,00
08/03/2023	-	-	Kernelware	HDB Financial Services	A hacker using the alias Kernelware leaks 7.5 GB of customer data with over 72 million entries belonging to HDB Financial Services, a subsidiary of India’s largest private bank, HDFC Bank.	Unknown	Finance and insurance	Cyber Crime	IN		Kernelware, HDB Financial Services, HDFC Bank	72,00	72.000.000,00
10/03/2023	Between 28/01/2023 and 29/01/2023	28/01/2023	?	Zoll Medical	Medical technology developer Zoll Medical notifies roughly one million individuals that their personal information might have been compromised in a recent data breach.	Unknown	Professional, scientific and technical	Cyber Crime	US		Zoll Medical	1,00	1.004.443,00
14/03/2023	Between 30/06/2022 and 05/07/2022	05/07/2022	?	Independent Living Systems (ILS)	Independent Living Systems (ILS), a Miami-based healthcare administration and managed care solutions provider, discloses a data breach that exposed the personal information of 4,226,508 individuals.	Unknown	Human health and social work	Cyber Crime	US		Independent Living Systems, ILS	4,23	4.226.508,00
23/03/2023	03/01/2023	23/01/2023	?	iD Tech	Attackers steal the personal data of about one million of users from kids’ tech coding camp iD Tech.	Unknown	Education	Cyber Crime	US		iD Tech	1,00	1.000.000,00
27/03/2023	-	-	Six members of a criminal gang	Multiple organizations in India	Indian police arrests six members of an alleged criminal gang that sold the personal data of 168 million Indian citizens, including defense personnel and government employees.	>1	Multiple Industries	Cyber Crime	IN			168,00	168.000.000,00
27/03/2023	16/03/2023	16/03/2023	?	Latitude Financial Services	Australian financial services company Latitude Financial Services reveals that personal information of approximately 14 million individuals might have been compromised in a data breach.	Unknown	Finance and insurance	Cyber Crime	AU		Latitude Financial Services	14,00	14.000.000,00
30/03/2023	Early December 2022	13/02/2023	?	TMX Finance	TMX Finance and its subsidiaries TitleMax, TitleBucks, and InstaLoan have collectively disclosed a data breach that exposed the personal data of 4,822,580 customers.	Unknown	Finance and insurance	Cyber Crime	CA		TMX Finance,TitleMax, TitleBucks, InstaLoan	4,82	4.822.580,00
31/03/2023	-	24/03/2023	?	Blauw	Blauw, a dutch marketing firm suffers a data breach affecting 1.5 million individuals.	Unknown	Professional, scientific and technical	Cyber Crime	NL		Blauw	1,50	1.500.000,00
01/04/2023	-	-	9Near	Unnamed Thai Government Agency	A hacker named "9Near" claims to have stolen the personal data of 55 million Thai citizens from an unnamed Government agency.	Unknown	Public admin and defence, social security	Hacktivism	TH		9Near	55,00	55.000.000,00
13/04/2023	30/01/2023	-	?	NationsBenefits Holding	NationsBenefits Holding files a notice of data breach after learning that the company and its customers were affected by the third-party data breach at Fortra.	CVE-2023-0669 Fortra GoAnywhere MFT Vulnerability	Finance and insurance	Cyber Crime	US		NationsBenefits Holding, Fortra, CVE-2023-0669 GoAnywhere MFT	3,00	3.000.000,00
20/04/2023	17/03/2023	Between 06/03/2023 and 17/03/2023	?	American Bar Association (ABA)	The American Bar Association (ABA) discloses a data breach after hackers compromised its network and gained access to older credentials for 1,466,000 members.	Unknown	Professional, scientific and technical	Cyber Crime	US		American Bar Association, ABA	1,47	1.466.000,00
23/04/2023	During February 2023	23/04/2023	?	Terravision	The Airport transfers service Terravision suffers a data breach, exposing over 2M records of customer data including names, phone numbers, email addresses, salted password hashes and in some cases, date of birth and country of origin.	Unknown	Transportation and storage	Cyber Crime	IT		Terravision	2,00	2.000.000,00
25/04/2023	-	-	?	Unknown organization in China	Unknown threat actors post a massive data set on a Russian forum, allegedly offering the opportunity to buy sensitive details of over 630 million users from China.	Unknown	Unknown	Cyber Crime	CN		China	640,00	640.000.000,00
26/04/2023	-	-	Undisclosed Ukrainian man	Individuals in Eastern Europe	The Cyber Police of Ukraine arrests a man for selling the personal data of more than 300 million individuals stolen via closed groups and channels in Telegram. Stolen information includes Ukrainian and European passport, taxpayer and driver's license numbers, as well as bank account data and birth certificates	Account Takeover	Individual	Cyber Crime	>1		Ukraine	360,00	360.000.000,00
28/04/2023	Between 29/03/2023 and 14/04/2023	30/03/2023	?	NextGen Healthcare	NextGen Healthcare, a U.S.-based provider of electronic health record software, admits that hackers breached its systems and stole the personal data of 1.05 million patients.	Account Takeover	Professional, scientific and technical	Cyber Crime	US		NextGen Healthcare	1,01	1.005.000,00
11/05/2023	-	28/04/2023	?	Brightly	Software maker Brightly confirms that hackers stole close to three million SchoolDude user accounts in an April data breach.	Malware	Professional, scientific and technical	Cyber Crime	US		Brightly, SchoolDude	3,00	3.000.000,00
12/05/2023	28/03/2023	14/03/2023	Money Message	PharMerica	PharMerica, one of the largest pharmacy service providers in the United States has confirmed that hackers accessed the personal data of almost six million patients.	Malware	Wholesale and retail	Cyber Crime	US		PharMerica, Money Message, ransomware	5,80	5.800.000,00
19/05/2023	16/03/2021	30/04/2023 and 12/05/2023	?	Luxottica	Luxottica confirms that one of its partners suffered a data breach in 2021 that exposed the personal information of 70 million customers after a database was posted for free on hacking forums.	Unknown	Manufacturing	Cyber Crime	IT		Luxottica	70,00	70.000.000,00
22/05/2023	From 05/04/2019 to 07/05/2019 and from 27/08/2021 to 10/10/2021	01/09/2021	?	Apria Healthcare	Apria Healthcare notifies over 1.8 million patients and employees that their personal, financial and health data was accessed during a systems hack.	Unknown	Human health and social work	Cyber Crime	US		Apria Healthcare	1,80	1.800.000,00
24/05/2023	From 28/03/2023 to 17/04/2023	17/04/2023	?	Harvard Pilgrim Health Care (HPHC)	Harvard Pilgrim Health Care (HPHC) discloses that a ransomware attack to its parent company Point32Health in April 2023 impacted 2,550,922 people, with the threat actors also stealing their sensitive data from compromised systems.	Malware	Human health and social work	Cyber Crime	US		Harvard Pilgrim Health Care, HPHC, ransomware, Point32Health	2,55	2.550.922,00
24/05/2023	01/02/2023	04/02/2023	?	NCB Management Services	NCB Management Services starts sending breach notification letters to affected users about a data breach that exposed nearly 1.1 million people. The company has hinted at paying a ransom to attackers.	Malware	Finance and insurance	Cyber Crime	US		NCB Management Services	1,10	1.100.000,00
26/05/2023	Between 26/02/2023 and 07/03/2023	06/03/2023	LockBit 3.0	Managed Care of North America (MCNA)	A LockBit ransomware attack on Managed Care of North America (MCNA), a major dental insurance provider , compromises the personal information of nearly nine million people across the United States, according to documents filed with state regulators.	Malware	Human health and social work	Cyber Crime	US		LockBit, LockBit 3.0, ransomware, Managed Care of North America, MCNA	9,00	9.000.000,00
30/05/2023	06/04/2023	06/04/2023	?	Enzo Biochem	A ransomware attack on Enzo Biochem resulted in the compromise of test information and personal data of nearly 2.5 million people, according to regulatory filings.	Malware	Professional, scientific and technical	Cyber Crime	US		Enzo Biochem, Ransomware	2,50	2.500.000,00
07/06/2023	-	31/05/2023	Clop AKA Lace Tempest, TA505 and, FIN11	BORN Ontario	BORN Ontario (Better Outcomes Registry & Network) reveals to have been hit by a data breach related to MOVEit CVE-2023-34362 vulnerability.	CVE-2023-34362 Vulnerability	Public admin and defence, social security	Cyber Crime	CA		BORN, Ontario, Better Outcomes Registry & Network, MOVEit, CVE-2023-34362, Clop, Lace Tempest, TA505, FIN11	3,40	3.400.000,00
09/06/2023	-	-	?	e-Devlet	A website called sorgupaneli.org is offering to provide Turkish 85 million citizens’ private data allegedly stolen from the e-Devlet government services website, even claiming to be able to offer President Recep Tayyip Erdogan’s personal information.	Unknown	Public admin and defence, social security	Cyber Crime	TR		sorgupaneli.org, e-Devlet, Recep Tayyip Erdogan	85,00	85.000.000,00
09/06/2023	-	09/06/2023	?	NHS	1.1 million records belonging to NHS are compromised in the University of Manchester cyberattack (rumored as ransomware) where threat actors likely stole data from the University's network.	Malware	Human health and social work	Cyber Crime	GB		NHS, ransomware	1,10	1.100.000,00
12/06/2023	-	During June 2023	?	Zacks Investment Research	Zacks Investment Research (Zacks) reportedly suffers an older, previously undisclosed data breach impacting 8.8 million customers, with the database now shared on a hacking forum.	Unknown	Professional, scientific and technical	Cyber Crime	US		Zacks Investment Research	8,80	8.800.000,00
15/06/2023	Since 27/05/2023	-	Clop AKA Lace Tempest, TA505 and, FIN11	Louisiana Office of Motor Vehicles	Louisiana Office of Motor Vehicles warns that six millions of driver's licenses were exposed in a data breach after the Clop ransomware gang hacked their MOVEit Transfer security file transfer systems to steal stored data.	CVE-2023-34362 Vulnerability	Public admin and defence, social security	Cyber Crime	US		Clop, Lace Tempest, TA505, FIN11, Louisiana Office of Motor Vehicles, MOVEit, CVE-2023-34362	6,00	6.000.000,00
15/06/2023	Since 27/05/2023	01/06/2023	Clop AKA Lace Tempest, TA505 and, FIN11	Oregon Office of Motor Vehicles	Oregon Office of Motor Vehicles warns that six millions of driver's licenses were exposed in a data breach after the Clop ransomware gang hacked their MOVEit Transfer security file transfer systems to steal stored data.	CVE-2023-34362 Vulnerability	Public admin and defence, social security	Cyber Crime	US		Clop, Lace Tempest, TA505, FIN11, Oregon Office of Motor Vehicles, MOVEit, CVE-2023-34362	3,50	3.500.000,00
23/06/2023	27/05/2023	-	Clop AKA Lace Tempest, TA505 and, FIN11	PBI Research Services (PBI)	PBI Research Services (PBI) suffers a data breach with three clients (Genworth Financial, Wilton Reassurance, and CalPERS - California Public Employees' Retirement System) disclosing that the data for 4.75 million people was stolen in the recent MOVEit Transfer data-theft attacks.	CVE-2023-34362 Vulnerability	Administration and support service	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, PBI Research Services, PBI, Genworth Financial, Wilton Reassurance, CalPERS, California Public Employees' Retirement System, MOVEit, CVE-2023-34362	4,75	4.750.000,00
23/06/2023	-	-	?	Undisclosed airport	The database of an undisclosed Italian airport with 7.8 million records is on sale in the dark web.	Unknown	Transportation and storage	Cyber Crime	IT		Italian Airport	7,80	7.800.000,00
05/07/2023	-	-	Bjorka	Unknown organizations in Indonesia	The personal information of nearly 35 million Indonesian passport holders is up for sale on the dark web for $10,000 by notorious hacktivist Bjorka.	Unknown	Unknown	Hacktivism	ID		Bjorka, Indonesia	35,00	35.000.000,00
11/07/2023	-	05/07/2023	?	HCA Healthcare	HCA Healthcare discloses a data breach impacting an estimated 11 million patients who received care at one of its hospitals and clinics after a threat actor leaked samples of the stolen data on a hacking forum.	Unknown	Human health and social work	Cyber Crime	US		HCA Healthcare	11,00	11.000.000,00
14/07/2023	-	-	Clop AKA Lace Tempest, TA505 and, FIN11	Teachers Insurance and Annuity Association of America (TIAA)	Teachers Insurance and Annuity Association of America (TIAA) files a notice of data breach after discovering to have been hit by the MOVEit CVE-2023-34362 vulnerability.	CVE-2023-34362 Vulnerability	Finance and insurance	Cyber Crime	US		Teachers Insurance and Annuity Association of America, TIAA, Clop, Cl0p, MOVEit, CVE-2023-34362, ransomware	2,60	2.600.000,00
19/07/2023	31/05/2023	31/05/2023	?	Tampa General Hospital	Tampa General Hospital discloses that the sensitive data of 1.2 million was stolen in a failed ransomware attack.	Malware	Human health and social work	Cyber Crime	US		Tampa General Hospital, ransomware	1,20	1.200.000,00
23/07/2023	-	-	?	Egyptian Ministry of Health and Population	An ‘established’ threat actor claims to be in possession of two million data records stolen from the Egyptian Ministry of Health and Population.	Unknown	Public admin and defence, social security	Cyber Crime	EG		Egyptian Ministry of Health and Population	2,00	2.000.000,00
26/07/2023	-	-	Clop AKA Lace Tempest, TA505 and, FIN11	Maximus	U.S. government contractor Maximus confirms that the Clop Ransomware gang, exploiting the vulnerability in MOVEit Transfer accessed the protected health information of as many as 11 million individuals.	CVE-2023-34362 Vulnerability	Professional, scientific and technical	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, Maximus, MOVEit, CVE-2023-34362, ransomware	11,00	11.000.000,00
02/08/2023	30/05/2023	02/06/2023	Clop AKA Lace Tempest, TA505 and, FIN11	Performance Health Technology (PH Tech)	Performance Health Technology (PH Tech), a company that provides data management services to U.S. healthcare insurers, confirms in a notice that it was impacted by the MOVEit mass-hacks	CVE-2023-34362 Vulnerability	Professional, scientific and technical	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, Performance Health Technology, PH Tech, MOVEit, CVE-2023-34362, ransomware	1,70	1.700.000,00
08/08/2023	-	-	Clop AKA Lace Tempest, TA505 and FIN11	Missouri's Department of Social Services	Missouri's Department of Social Services warns that protected Medicaid healthcare information was exposed in a data breach after IBM suffered a MOVEit data theft attack.	CVE-2023-34362 Vulnerability	Public admin and defence, social security	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, MOVEit Transfer, IBM Consulting, Missouri's Department of Social Services, CVE-2023-34362, ransomware	6,00	6.000.000,00
10/08/2023	-	09/07/2023	8base	Alberta Dental Service Corporation (ADSC)	Canadian dental benefits administrator Alberta Dental Service Corporation (ADSC) starts informing roughly 1.47 million individuals that their personal information was compromised in a 8base ransomware attack.	Malware	Administration and support service	Cyber Crime	CA		Alberta Dental Service Corporation, ADSC, 8base, ransomware	1,47	1.470.000,00
11/08/2023	28/05/2023	13/06/2023	Clop AKA Lace Tempest, TA505 and FIN11	Colorado Department of Health Care Policy & Financing (HCPF)	The Colorado Department of Health Care Policy & Financing (HCPF) alerts more than four million individuals of a data breach that impacted their personal and health information, after IBM suffered a MOVEit data theft attack.	CVE-2023-34362 Vulnerability	Public admin and defence, social security	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, MOVEit Transfer, IBM Consulting, Colorado Department of Health Care Policy & Financing, HCPF, CVE-2023-34362, ransomware	4,00	4.000.000,00
11/08/2023	-	10/08/2023	Fredens of Security	India Ministry of Food Processing Industries	A threat actor dubbed Fredens of Security takes credit for exposing 4.5GB, purportedly containing 3 million records linked to India’s Ministry of Food Processing.	Unknown	Public admin and defence, social security	Hacktivism	IN		Fredens of Security, India, Ministry of Food Processing	3,00	3.000.000,00
11/08/2023	-	10/08/2023	Fredens of Security	India Ministry of Health & Family Welfare	A threat actor dubbed Fredens of Security takes credit for exposing 4.5GB, purportedly containing 3 million records linked to India's Ministry of Health & Family Welfare	Unknown	Public admin and defence, social security	Hacktivism	IN		Fredens of Security, India, Ministry of Health & Family Welfare	1,00	1.000.000,00
11/08/2023	-	10/08/2023	PieWithNothing	Shemaroo Entertainment	A user on a hacker forum is allegedly selling data attributed to Shemaroo Entertainment. The attacker claims that this compromised dataset contains 16.4 million user entries, exposing sensitive details such as email addresses, passwords, phone numbers, and additional personal information.	Unknown	Arts entertainment, recreation	Cyber Crime	IN		Shemaroo Entertainment, PieWithNothing	16,40	16.400.000,00
21/08/2023	-	16/08/2023	FocaLeaks	Unknown origanization in the healthcare sector	A database with 14GB of files with facial photos and 5.1 million records with El Salvadorans personal information is listed for sale on a popular hacking forum.	Unknown	Human health and social work	Cyber Crime	SV		FocaLeaks	5,10	5.100.000,00
22/08/2023	-	-	Clop AKA Cl0p	Pôle Emploi	Pôle Emploi, France's governmental unemployment registration and financial aid agency, informs of a data breach that exposed data belonging to 10 million individuals.	CVE-2023-34362 Vulnerability	Public admin and defence, social security	Cyber Crime	FR		Clop, Cl0p, Lace Tempest, TA505, FIN11, MOVEit Transfer, Pôle Emploi, CVE-2023-34362, ransomware	10,00	10.000.000,00
22/08/2023	-	-	?	University of Minnesota	The University of Minnesota confirms that it is investigating a data breach after hackers claimed to have obtained over seven million Social Security numbers from the school’s computer network.	Unknown	Education	Cyber Crime	US		University of Minnesota	7,00	7.000.000,00
25/08/2023	16/01/2023	10/07/2023	?	PurFoods	PurFoods the parent company of Mom’s Meals, a meal delivery service for people with chronic health conditions, confirms a data breach affecting more than 1.2 million individuals.	Unknown	Accomodation and food service	Cyber Crime	US		PurFoods, Mom’s Meals	1,20	1.200.000,00
29/08/2023	01/08/2023	01/08/2023	?	Topgolf Callaway	Topgolf Callaway (Callaway) reveals to have suffered a data breach at the start of August, which exposed the sensitive personal and account data of more than a million customers.	Unknown	Manufacturing	Cyber Crime	US		Topgolf Callaway	1,11	1.114.954,00
03/09/2023	-	30/08/2023	?	Freecycle.org	Freecycle.org, a platform that allows users to recycle their belongings, prompts 7 millions of users to reset their passwords after their credentials were compromised in a data breach.	Unknown	Human health and social work	Cyber Crime	GB US		Freecycle.org, Freecycle	7,00	7.000.000,00
03/09/2023	Between July and August 2023	03/09/2023	ShinyHunters	Pizza Hut Australia	More than one million customers of Pizza Hut Australia appear to have had their data acquired by the threat actor named ShinyHunters.	Misconfiguration	Accomodation and food service	Cyber Crime	AU		Pizza Hut Australia	1,00	1,00
07/09/2023	-	-	victim	Traderie	In-game trading marketplaces Traderie and another marketplace, Nookazon, owned by the same parent company Akrew, alert users to a data breach impacting their personal information. A threat actor called “victim” claims to be selling the data of as many as 2.6 million users for $5,000 in bitcoin.	Unknown	Arts entertainment, recreation	Cyber Crime	US		Traderie, Nookazon, Akrew, victim	2,60	2.600.000,00
08/09/2023	Since at least June 2023	06/09/2023	?	Dymocks	Dymocks Booksellers warns customers their personal information was exposed in a data breach after the company's database was shared on hacking forums.	Unknown	Wholesale and retail	Cyber Crime	AU		Dymocks	1,20	1.200.000,00
18/09/2023	-	-	?	Virginia Department of Medical Assistance Services	The Virginia Department of Medical Assistance Services (DMAS) files a notice of data breach.	Unknown	Human health and social work	Cyber Crime	US		Virginia Department of Medical Assistance Services, DMAS	1,23	1.229.333,00
21/09/2023	-	-	?	Undisclosed company in Pakistan	More than 2 million Pakistani citizens are facing risk of data leak as attackers get access to a private company-made database used by hundreds of restaurants.	Unknown	Professional, scientific and technical	Cyber Crime	PK		Pakistan	2,00	2.000.000,00
28/09/2023	-	-	Clop AKA Lace Tempest, TA505, and FIN11	Arietis Health	Arietis Health is added to the list of entities affected by the MOVEit breach. 1,975,066 individuals are affected.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, MOVEit Transfer, Arietis Health, CVE-2023-34362, ransomware	1,98	1.975.066,00
29/09/2023	-	29/09/2023	ALPHV AKA BlackCat	McLaren HealthCare	McLaren HealthCare, confirms to be dealing with a ransomware after the BlackCat ransomware group takes credit for the incident. 2.5 million users are affected.	Malware	Human health and social work	Cyber Crime	US		McLaren HealthCare, ransomware, BlackCat, ALPHV	2,50	2.500.000,00
Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Geo	Link	Tags	Records Raw	Records

Enjoy the data, and thanks for sharing it, and supporting my work in spreading the risk awareness across the community. Also, don’t forget to follow @paulsparrows on Twitter, or even connect on Linkedin, for the latest updates.

BE NOTIFIED OF NEW BLOG POSTS: SUSCRIBE!

16-30 September 2023 Cyber Attacks Timeline
The second cyber attack timeline of September 2023 showed a decrease in events and a continuation of malware attacks. Massive hacks targeted fintech organizations like Mixin Network, and some breaches affected millions of individuals. The timeline also includes activities by various known and new threat ...
The Biggest Data Breaches of 2023
Similarly to what I have done in 2022 and 2021, I am collecting the main mega breaches...
August 2023 Cyber Attacks Statistics
After the cyber attacks timelines (part I and part II), it’s time to publish the statistics of August 2023 where I have collected and analyzed 336 events, a number relatively...
1-15 September 2023 Cyber Attacks Timeline
The first cyber attack timeline of September 2023 reveals a record-breaking 13.93 events/day, a worrying increase from August's downward trend. Ransomware and malware attacks continue to be prevalent, making up 39.7% of the threat landscape, a rise from 34.5%. The impact of vulnerabilities remains vital ...
2020 Cyber Attacks Statistics
As promised, I have pulled together some statistics from the data collected in 2020. The master table is available at the end of the post after the charts.