> series: anatomy_of_a_breach —— part: 048 —— year: 2012 —— verdict: credentials_burned_infrastructure_destroyed<span class="cursor-blink">_</span>_
2012 was defined by two parallel trends: the industrial-scale theft of credentials and the emergence of destructive nation-state attacks. LinkedIn's 117 million accounts, the credential dump summer (Last.fm, eHarmony, Yahoo Voices), and the continuation of sophisticated phishing campaigns demonstrated that the internet's credential infrastructure was comprehensively broken — a trend the Verizon DBIR confirmed. Simultaneously, Shamoon's destruction of 30,000 Saudi Aramco workstations and Flame's revelation as a 20MB espionage platform confirmed that nation-state cyber capabilities had matured from Stuxnet's surgical precision into both comprehensive surveillance and mass destruction.
In the UK, the ICO continued its enforcement trajectory — fining NHS trusts, police forces, and councils for the same basic failures that have appeared in every year of this series. And in a corporate boardroom in Canada, the decade-long Nortel Networks espionage was finally revealed by the Wall Street Journal, proving that nation-state intrusions can persist for longer than the company itself survives.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call| # | Breach | Key Lesson |
|---|---|---|
| 037 | Zappos | 24M accounts — but bcrypt passwords, segregated cards, and transparent response showed how to do it right. |
| 038 | Nortel Networks | A decade of Chinese espionage. Discovered in 2004, ignored by management, persisted until bankruptcy. |
| 039 | Global Payments | 1.5M cards, Visa delisting. Third payment processor breached in this series. PCI compliance did not prevent it. |
| 040 | Anonymous vs UK Gov | Home Office, Downing Street, MoJ taken offline. UK government web infrastructure lacked DDoS resilience. |
| 041 | Flame | 20MB espionage platform. Audio surveillance, Bluetooth theft, forged Windows Update certs. Nation-state tools evolved. |
| 042 | 117 million accounts with unsalted SHA-1. The credential mega-breach that fuelled years of credential stuffing. | |
| 043 | Credential Dump Summer | Last.fm (43M), eHarmony (1.5M), Yahoo Voices (plaintext). 160M+ credentials exposed in weeks. |
| 044 | Saudi Aramco / Shamoon | 30,000 workstations wiped. First major destructive wiper. Nation-states can and will destroy infrastructure. |
| 045 | GMP Memory Stick | 1,075 serious crime records on an unencrypted USB. Five years after HMRC, the same failure persists. |
| 046 | South Carolina DOR | 3.6M SSNs, unencrypted. 'Not legally required' is not a security strategy. |
| 047 | UK ICO Enforcement | £4M+ in fines. NHS, police, councils. The same four failure categories, year after year. |
| 048 | 2012 Year in Review | Credentials burned, infrastructure destroyed. The scale keeps growing. The basics still matter. |
With 48 articles spanning four years, this series has documented the evolution of the cyber threat landscape from HMRC's lost CDs to Saudi Aramco's wiped workstations, from a single SQL injection in a Marshalls store to the systematic theft of 160 million credentials in a single summer. The threats have scaled. The techniques have evolved. But the root causes — unpatched systems, weak passwords, absent encryption, missing segmentation, inadequate monitoring, and the persistent gap between security policy and security practice — have remained stubbornly consistent.
The organisations that have survived this escalation are the ones that implemented the basics: tested their defences, certified their baseline controls, monitored their environments continuously, and maintained incident response capability for when prevention failed. The Anatomy of a Breach series continues into 2013 — a year that will bring Adobe (153 million accounts), Target (110 million customers), and the Snowden revelations. The scale keeps growing. The basics still matter.
<a href="/penetration-testing">Penetration testing</a>. <a href="/cyber-essentials">Cyber Essentials</a>. <a href="https://www.socinabox.co.uk">SOC in a Box</a>. <a href="https://www.cyber-defence.io">Incident response</a>. Four years of evidence. One conclusion. Start now.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call