Major Data Breaches and Cyberattacks

Passports, KYC selfies, IBAN statements, and full transaction history (including Bitcoin) disclosed to an attacker posing as an official agency.

Cause : Government agency impersonation request via email with valid domain authentication credentials.

Fake security alerts sent from the genuine help@trezor.io address after the French Brevo platform was compromised; 2,500 clicks before the domain was cut in 20 minutes.

Cause : Unauthorized access to the sending system, used to dispatch phishing from legitimate senders.

3,400 BTC returned after an on-chain negotiation; about 598 BTC ($47M) remain with the attackers despite the "white hat" label.

Cause : Bug in the Elements software allowing creation of unbacked L-BTC and triggering a peg-out.

The ShinyHunters gang claims over 200,000 driver records stolen via a compromised institutional account, with proof of the breach.

Cause : Police department user's credentials stored on a personal device (official version); password reset flaw claimed by attackers.

France's tax authority confirms illegitimate access to its systems, reviving the debate over public-sector security.

Cause : Impersonated agent credentials and lack of widespread MFA across the tax administration's information system.

The logistics arm of French shipping group CMA CGM had major clients' orders blocked and their data exfiltrated, triggering class-action lawsuits in the US.

Cause : Ransomware attack paralyzing eight European warehouses; the CoinbaseCartel group is named in ongoing legal proceedings.

The portal handling vehicle registration, driving licences and ID cards exposed millions of French residents' data through an authorization flaw that was trivial to fix.

Cause : Elementary IDOR vulnerability on the portal: changing an identifier in an API request granted access to other users' accounts.

The French tire manufacturer had internal manufacturing, engineering and HR files claimed by Cl0p, part of a MOVEit-style campaign targeting Oracle's ERP suite.

Cause : Pre-authentication zero-day in Oracle E-Business Suite (CVE-2025-61882), exploited by the Cl0p group in an extortion campaign hitting 100+ organizations.

A further compromise at the same operator, revealing persistent weaknesses in internal access security.

Cause : A second, separate security incident roughly 18 months after the first breach.

One of the largest French telecom incidents, followed by a record CNIL fine for failing to secure customer data.

Cause : Intrusion into internal systems, exfiltration of contracts and bank details; resulted in a €42 million CNIL fine.

The first of two distinct security incidents suffered by the operator in less than two years.

Cause : Compromise of an internal management tool exposing contracts and contact details.

A little-known data broker had decades of personal history records resold on criminal forums.

Cause : A data broker's database exposed, containing address histories and social security numbers.

Two distinct 2024 incidents: republication of old data, then a massive theft of call and text metadata for nearly all customers.

Cause : Historical leak republished, plus a separate theft of call and text records via a compromised Snowflake cloud account.

One of the largest ticketing data breaches in history, exposing names, emails and partial payment data of customers worldwide.

Cause : Compromise of customer Snowflake accounts lacking MFA, part of a wave of attacks hitting multiple companies.

Names, social security numbers and registration status of nearly all French workers and jobseekers exposed.

Cause : Unauthorized access via compromised advisor/agent credentials at France's employment agency.

The attack paralyzed billing and reimbursement across a large part of the US healthcare system for weeks, with an estimated $22 million ransom paid.

Cause : ALPHV/BlackCat ransomware via Citrix credentials without multi-factor authentication.

Health data (insurer, reimbursements) of half the French population exposed via two separate providers hit in parallel.

Cause : Double compromise of two French health third-party payment operators via stolen professional credentials.

Sensitive genetic and genealogical data exposed, with attackers claiming to target Ashkenazi Jewish and Chinese profiles.

Cause : Credential stuffing on accounts reusing passwords, then abuse of the DNA Relatives feature to widen the exposure.

A single phone call to the help desk paralyzed the group's casinos and hotels for days, at an estimated cost of $100 million.

Cause : Vishing social engineering against the IT help desk (Scattered Spider group), followed by ransomware.

Days before the MGM Resorts attack, the same threat actors targeted Caesars, which chose to pay the ransom.

Cause : Vishing social engineering against IT support (Scattered Spider group); roughly $15 million ransom paid.

The largest data-extortion campaign ever run through a single software vulnerability, hitting hundreds of organizations worldwide.

Cause : Zero-day SQL injection in MOVEit Transfer, exploited at scale by the Cl0p group.

The password manager had customer backups stolen; real-world impact depends on the strength of each user's master password.

Cause : Compromise of a developer's workstation, followed by theft of encrypted vault backups from the cloud.

A lone attacker gained full administrator access to Uber's Slack, AWS, GSuite and financial tools within hours.

Cause : Social engineering and MFA fatigue by an 18-year-old attacker, full access to internal tools.

Several French retail chains notified customers of a contact-details leak (name, email, phone) via a shared contractor.

Cause : Leak via a shared customer relationship management contractor, hitting several retail chains in parallel.

Emails and phone numbers linked to accounts were aggregated and later leaked for free, exposing anonymous accounts to re-identification.

Cause : Vulnerable API allowing phone numbers or emails to be matched to accounts, abused for mass scraping.

The hospital operated in degraded mode for weeks after an attack that encrypted its information system and exposed patient data.

Cause : LockBit ransomware; a $10 million ransom was demanded and refused by the hospital, with data published in retaliation.

La Poste Group's mobile operator took several weeks to restore services following a ransomware attack.

Cause : Ransomware paralyzing billing and customer support for several weeks.

Professional and personal data of nearly all active users aggregated and resold on specialized forums.

Cause : Mass scraping of public profiles via the API, without exploiting a vulnerability in the strict sense.

Phone numbers, full names and locations of over half a billion users republished for free on a hacking forum.

Cause : Mass scraping via a contact-import feature, patched in 2019 but already abused before the fix.

Compromised healthcare professional credentials allowed extraction of data on hundreds of thousands of France's national health insurance policyholders.

Cause : Stolen healthcare professional credentials used to query the ameli pro teleservice.

The operator confirmed unauthorized access to business customer data via one of its management platforms.

Cause : Intrusion into an internal management platform dedicated to business customers.

The decade's most significant software supply-chain attack, hitting US federal agencies and Fortune 500 companies.

Cause : Malicious implant injected into Orion software updates by the Nobelium group.

One of France's largest IT services firms paralyzed for days by ransomware, in the same wave as the Groupe M6 attack.

Cause : Ryuk ransomware encrypting part of the IT services firm's information system.

The TV group kept broadcasting despite an attack that blocked a large part of its information system.

Cause : Ryuk ransomware paralyzing the broadcast group's internal systems and operations for several days.

France's employment agency warned hundreds of thousands of jobseekers after uncovering a phishing campaign built on data stolen from a partner.

Cause : Data leak at a third-party contractor, later reused for a targeted phishing campaign.

Credit applications, social security numbers and bank data exfiltrated from a poorly protected cloud storage bucket.

Cause : Misconfigured web application firewall (SSRF) exploited by a former employee of an AWS cloud contractor.

Passport numbers, birth dates and card data of hundreds of millions of hotel guests exposed over an unusually long dwell time.

Cause : Intrusion left undetected for roughly four years inside the Starwood reservation database after the acquisition.

Social security numbers, birth dates and addresses of nearly half of Americans exposed through a known, neglected web vulnerability.

Cause : Known Apache Struts CVE, left unpatched despite a fix having been available for months.

The largest data breach ever recorded: every single Yahoo account at the time, disclosed in waves during 2016-2017 for intrusions dating back to 2013.

Cause : Credentials stolen by suspected state-sponsored actors; passwords hashed with obsolete MD5.