Anatomy of a Breach

Anatomy of a Breach: 2015 Year in Review — Data as a Weapon and the First Cyber Attack on a Power Grid

> series: anatomy_of_a_breach —— part: 084 —— year: 2015 —— verdict: everything_is_a_target<span class="cursor-blink">_</span>_

Hedgehog Security 31 December 2015 14 min read
data-breach year-in-review 2015 ukraine-power-grid talktalk ashley-madison opm series
Breach #084

2015: data weaponised, power grids attacked, children's photos stolen. Everything is a target.

2015 closed with an event that security professionals had long warned about but many considered hypothetical: on 23 December, Russian state-sponsored hackers attacked three Ukrainian power distribution companies, using the BlackEnergy malware and KillDisk wiper to disable SCADA systems and leave approximately 230,000 customers without electricity for up to six hours. It was the first confirmed cyber attack to take down a power grid — and it demonstrated that the theoretical threat to critical infrastructure documented since Stuxnet (2010) was now operational reality.

The Ukraine power grid attack was the capstone of a year that proved everything is a target. Ashley Madison showed data can destroy lives. TalkTalk showed UK businesses are not prepared. OPM lost 21.5 million security clearances. Anthem and Premera proved healthcare is under sustained attack. VTech exposed 6.4 million children. And Hacking Team's leaked zero-days armed every criminal on the internet. No sector, no data type, and no organisation was safe.

The Breaches
Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Twelve months. Everything is a target.

# Breach Key Lesson
073 Moonpig UK: API with zero authentication. Any customer ID returned any customer's data. Ignored for 17 months.
074 Anthem 78.8M health records. Largest healthcare breach ever. $115M settlement.
075 Premera Blue Cross 11M records including clinical data. Healthcare under sustained APT attack.
076 GitHub Great Cannon China weaponised millions of internet users to DDoS anti-censorship tools.
077 US OPM 21.5M security clearances + 5.6M fingerprints. The most damaging intelligence theft in US history.
078 LastPass The password manager was breached. Even the vault that protects your passwords needs protection.
079 Hacking Team 400GB leaked including zero-days. Surveillance vendor hacked, exploits went wild within days.
080 Ashley Madison 32M affair-seekers exposed. Extortion, divorces, suicides. Data as a weapon of shame.
081 Carphone Warehouse UK: 2.4M customers, £400K fine. Outdated WordPress, no testing, no WAF.
082 TalkTalk UK: SQL injection by a 15-year-old. CEO on live TV. £400K fine. 101K customers lost.
083 VTech 6.4M children. Photos. Chat logs. SQL injection + MD5. The most vulnerable data, the weakest protection.
084 Ukraine Power Grid + Review First cyber attack on a power grid. 230,000 without electricity. Everything is a target.
The Themes

What 2015 established permanently.

Cyber Attacks Can Turn Off the Lights
The Ukraine power grid attack proved that the Stuxnet-era theoretical risk — cyber attacks causing physical consequences to critical infrastructure — was now operational. For UK organisations operating critical national infrastructure, this is no longer a theoretical scenario to plan for — it is a proven capability that adversaries have demonstrated. <a href="/blog/sector-under-the-microscope-manufacturing">Our manufacturing</a> and critical infrastructure analyses examine this threat.
Data Weaponisation Is Real
<a href="/blog/anatomy-of-a-breach-ashley-madison">Ashley Madison</a> proved data can be weaponised to destroy lives. <a href="/blog/anatomy-of-a-breach-opm">OPM</a> proved it can be weaponised for intelligence operations. <a href="/blog/anatomy-of-a-breach-hacking-team">Hacking Team</a> proved it can be weaponised for mass exploitation. Data is not just an asset — it is a weapon when it falls into the wrong hands.
Children's Data Demands the Highest Protection
<a href="/blog/anatomy-of-a-breach-vtech">VTech's</a> exposure of 6.4 million children's photos and chat logs with SQL injection and MD5 passwords established that organisations handling children's data bear the highest responsibility — and often demonstrate the lowest security. The UK's Children's Code (AADC) was a direct legislative response.
SQL Injection: Year Seven
SQL injection compromised <a href="/blog/anatomy-of-a-breach-talktalk">TalkTalk</a> and <a href="/blog/anatomy-of-a-breach-vtech">VTech</a> in 2015 — seven years after it first appeared in this series with <a href="/blog/anatomy-of-a-breach-heartland-payment-systems">Heartland</a> (2008). The vulnerability that a 15-year-old can exploit continues to compromise FTSE 250 companies. The only conclusion: testing is not optional.
Seven Years Complete

84 articles. 2009 to 2015. Seven years of evidence. One inescapable conclusion.

With 84 articles spanning seven years, this series has documented the complete evolution of the modern threat landscape. From HMRC's lost CDs to Ukraine's darkened power grid, from Gonzalez's SQL injections to TalkTalk's teenage attacker, from T-Mobile's insider to Ashley Madison's 32 million exposed secrets. The threats have evolved from opportunistic to industrial to existential. The root causes have not changed. The controls remain the same. The organisations that implement them survive. The rest fill the pages of this series.

Penetration testing. Cyber Essentials. SOC in a Box. UK Cyber Defence. Seven years of evidence. One conclusion. Start now.

Seven Years of Evidence

84 breaches. Seven years. SQL injection still works. MFA still is not deployed. The basics still matter.

<a href="/penetration-testing">Test your defences</a>. <a href="/cyber-essentials">Certify your baseline</a>. <a href="https://www.socinabox.co.uk">Monitor continuously</a>. <a href="https://www.cyber-defence.io">Prepare for the worst</a>. Because everything is a target — and 84 breaches have proved it.

Commission a Penetration Test Back to 2015 — Breach #073
Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call
Keep Reading

Related Articles

Anatomy of a Breach 31 December 2021

Anatomy of a Breach: 2021 Year in Review — Log4Shell, Colonial Pipeline, and the Year Ransomware Became a National Security Crisis

Breach #156 and the 2021 finale. The year Colonial Pipeline shut down America's fuel supply through a single compromised VPN password, the Irish HSE was devastated by Conti ransomware, JBS paid $11 million to REvil, Kaseya's supply chain attack hit 1,500 businesses, Hafnium compromised 250,000 Exchange servers, someone tried to poison Florida's water through TeamViewer, T-Mobile was breached for the fifth time, and — on 9 December — Log4Shell (CVE-2021-44228) was disclosed: a critical remote code execution vulnerability in Apache Log4j, a logging library embedded in hundreds of millions of systems worldwide. The vulnerability in everything.

data-breach year-in-review
16 min read
Anatomy of a Breach 31 December 2020

Anatomy of a Breach: 2020 Year in Review — SolarWinds, COVID-19, and the Year the Supply Chain Broke

Breach #144 and the 2020 finale. The year COVID-19 transformed the global attack surface overnight, SolarWinds rewrote the supply chain threat model, ransomware claimed its first life at Düsseldorf, Twitter proved social engineering trumps technology, Hackney Council was devastated for two years, Garmin paid $10 million, and the pandemic-fuelled explosion of remote working created new vulnerabilities faster than they could be secured. Then, on 13 December, the SolarWinds/Sunburst supply chain attack was discovered — compromising 18,000 organisations including US government agencies — the most sophisticated supply chain attack in history.

data-breach year-in-review
16 min read
Anatomy of a Breach 31 December 2019

Anatomy of a Breach: 2019 Year in Review — Ransomware Industrialised, Credentials Commoditised, and Travelex Hit on New Year's Eve

Breach #132 and the 2019 finale. The year 2.2 billion credentials were dumped in Collection #1-5, Norsk Hydro showed the world how to handle ransomware with dignity, Capital One lost 106 million records through a cloud misconfiguration, WhatsApp proved that zero-click phone exploitation is real, Baltimore proved EternalBlue is still unpatched two years on, and on New Year's Eve — literally the last hours of the decade — REvil ransomware struck Travelex, the UK foreign exchange company, beginning a crisis that would disrupt UK banking services into 2020.

data-breach year-in-review
14 min read
All Posts Get in Touch