Anatomy of a Breach

Anatomy of a Breach: 2016 Year in Review — The Year of Billions, Botnets, and Election Interference

> series: anatomy_of_a_breach —— part: 096 —— year: 2016 —— verdict: billions_botnets_and_election_interference<span class="cursor-blink">_</span>_

Hedgehog Security 31 December 2016 14 min read
data-breach year-in-review 2016 yahoo mirai dnc shadow-brokers tesco-bank series
Breach #096

2016: Yahoo. Mirai. The DNC. The year the ceilings broke.

2016 closed with a disclosure that surpassed everything that came before: on 14 December, Yahoo announced that a separate breach — distinct from the 500 million accounts disclosed in September — had compromised approximately one billion user accounts in August 2013. In 2017, Yahoo would revise this figure to all three billion accounts — making it the largest data breach in history. In the same month, Adult Friend Finder disclosed that 412 million accounts across its network had been compromised, with passwords stored using weak SHA-1 hashing.

The Yahoo and Adult Friend Finder disclosures capped a year of record-breaking scale. The Bangladesh Bank SWIFT heist stole $81 million. The Panama Papers leaked 11.5 million documents. The mega-breach data dumps put 542 million credentials on the dark web. Russia hacked the DNC to influence a presidential election. The Shadow Brokers stole NSA cyber weapons. The Mirai botnet used IoT devices to take down Twitter, Netflix, and Reddit. And in the UK, Tesco Bank lost £2.5 million from 9,000 customer accounts. Every previous ceiling — in breach scale, in geopolitical impact, in financial theft — was broken.

The Breaches
Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Twelve months. Every record broken.

# Breach Key Lesson
085 Bangladesh Bank SWIFT $81M stolen through the global banking backbone. A typo saved $870M.
086 Hollywood Presbyterian Hospital pays $17K Bitcoin. Ransomware hits healthcare — WannaCry is 15 months away.
087 Panama Papers 11.5M documents via unpatched WordPress. World leaders exposed. A law firm destroyed.
088 Philippines COMELEC 55M voters' fingerprints and passports. Election security under existential threat.
089 Mega-Breach Data Dumps Myspace 360M + LinkedIn 117M + Tumblr 65M. 542 million credentials for sale.
090 DNC Hack / Russia Two Russian intelligence agencies. WikiLeaks. An election influenced. Phishing started it.
091 Credential Stuffing Epidemic TeamViewer, GoToMyPC, dozens more. 542M credentials weaponised. MFA is the only answer.
092 Shadow Brokers NSA's own tools stolen and auctioned. EternalBlue is coming. Patch or perish.
093 Yahoo 500M Disclosed two years late. $350M off the acquisition price. Cyber due diligence is essential.
094 Dyn / Mirai Botnet 100K webcams take down Twitter and Netflix. 62 default passwords. IoT is a weapon.
095 Tesco Bank UK: £2.5M stolen, 9K accounts, £16.4M FCA fine. 'Largely avoidable.'
096 Yahoo 1B + AFF 412M + Review Yahoo: 1 billion (later 3B). AFF: 412M. Every record broken. Every ceiling shattered.
The Themes

What 2016 established irreversibly.

Breach Scale: From Millions to Billions
Yahoo's one-billion-account breach (later three billion) and AFF's 412 million established that breaches are now measured in billions of records. The <a href="/blog/anatomy-of-a-breach-mega-breach-dumps">mega-breach dumps</a> put 542 million credentials on the market in a single month. <a href="/cyber-essentials">Cyber Essentials Danzell's</a> MFA auto-fail criterion exists because credential compromise at this scale is now the norm.
Election Interference Is a Cyber Threat
The <a href="/blog/anatomy-of-a-breach-dnc-hack">DNC hack</a> and the <a href="/blog/anatomy-of-a-breach-philippines-comelec">Philippines COMELEC breach</a> established that democratic processes are cyber targets. Nation-states will steal and weaponise political data to influence elections.
IoT Devices Are Cyber Weapons
The <a href="/blog/anatomy-of-a-breach-dyn-mirai">Mirai botnet</a> proved that insecure consumer devices — webcams, routers, DVRs — can be weaponised into DDoS tools powerful enough to disrupt the internet's core infrastructure. Default passwords are existential vulnerabilities.
Nation-State Weapons Are Leaking
The <a href="/blog/anatomy-of-a-breach-shadow-brokers">Shadow Brokers</a> stole the NSA's offensive tools. <a href="/blog/anatomy-of-a-breach-hacking-team">Hacking Team</a> was exposed in 2015. The proliferation of nation-state cyber weapons into criminal hands is accelerating — and WannaCry (May 2017) will demonstrate the consequences.
Eight Years Complete

96 articles. 2009 to 2016. WannaCry is five months away.

With 96 articles spanning eight years, this series has documented the complete transformation of cyber risk from an IT concern to a geopolitical, economic, and existential threat. From HMRC's lost CDs to Yahoo's three billion accounts, from Gonzalez's SQL injections to the NSA's stolen cyber weapons. The series continues into 2017 — the year WannaCry will devastate the NHS, NotPetya will cause $10 billion in global damage, and the Equifax breach will expose 147 million Americans. Everything that 2016 foreshadowed is about to arrive.

Penetration testing. Cyber Essentials. SOC in a Box. UK Cyber Defence. Eight years of evidence. One conclusion. The time to prepare was before the next headline. The next best time is now.

Eight Years of Evidence

96 breaches. Eight years. WannaCry is five months away. Are you ready?

<a href="/penetration-testing">Test</a>. <a href="/cyber-essentials">Certify</a>. <a href="https://www.socinabox.co.uk">Monitor</a>. <a href="https://www.cyber-defence.io">Respond</a>. Because 2017 will be worse.

Commission a Penetration Test Back to 2016 — Breach #085
Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call
Keep Reading

Related Articles

Anatomy of a Breach 31 December 2021

Anatomy of a Breach: 2021 Year in Review — Log4Shell, Colonial Pipeline, and the Year Ransomware Became a National Security Crisis

Breach #156 and the 2021 finale. The year Colonial Pipeline shut down America's fuel supply through a single compromised VPN password, the Irish HSE was devastated by Conti ransomware, JBS paid $11 million to REvil, Kaseya's supply chain attack hit 1,500 businesses, Hafnium compromised 250,000 Exchange servers, someone tried to poison Florida's water through TeamViewer, T-Mobile was breached for the fifth time, and — on 9 December — Log4Shell (CVE-2021-44228) was disclosed: a critical remote code execution vulnerability in Apache Log4j, a logging library embedded in hundreds of millions of systems worldwide. The vulnerability in everything.

data-breach year-in-review
16 min read
Anatomy of a Breach 31 December 2020

Anatomy of a Breach: 2020 Year in Review — SolarWinds, COVID-19, and the Year the Supply Chain Broke

Breach #144 and the 2020 finale. The year COVID-19 transformed the global attack surface overnight, SolarWinds rewrote the supply chain threat model, ransomware claimed its first life at Düsseldorf, Twitter proved social engineering trumps technology, Hackney Council was devastated for two years, Garmin paid $10 million, and the pandemic-fuelled explosion of remote working created new vulnerabilities faster than they could be secured. Then, on 13 December, the SolarWinds/Sunburst supply chain attack was discovered — compromising 18,000 organisations including US government agencies — the most sophisticated supply chain attack in history.

data-breach year-in-review
16 min read
Anatomy of a Breach 31 December 2019

Anatomy of a Breach: 2019 Year in Review — Ransomware Industrialised, Credentials Commoditised, and Travelex Hit on New Year's Eve

Breach #132 and the 2019 finale. The year 2.2 billion credentials were dumped in Collection #1-5, Norsk Hydro showed the world how to handle ransomware with dignity, Capital One lost 106 million records through a cloud misconfiguration, WhatsApp proved that zero-click phone exploitation is real, Baltimore proved EternalBlue is still unpatched two years on, and on New Year's Eve — literally the last hours of the decade — REvil ransomware struck Travelex, the UK foreign exchange company, beginning a crisis that would disrupt UK banking services into 2020.

data-breach year-in-review
14 min read
All Posts Get in Touch