2016 was a doozy. As many security experts predicted, we’ve seen cyberattacks happening at greater frequency and greater size. From customer information exfiltration to DDoS attacks taking down major websites and even a portion of the internet, we’ve made it through a history-changing year. Here’s our countdown of the 10 biggest cyberattacks of 2016.
Note: we determined the biggest cyberattacks of 2016 based on when the attack was announced, not when it was estimated to have happened.
10. Philippine Commission on Elections
In late March, Anonymous breached the database of the Philippine Commission on Elections (COMELEC) to prove that COMELEC needed to turn on security features in vote counting machines. As a result, the personal information of all 55 million voters in the Philippines was compromised. LulzSec Pilipinas published the information online shortly afterward. Infosecurity Magazine said the incident “could rank as the worst government data breach anywhere.”
9. Dropbox
Remember the Dropbox breach from 2012? Unfortunately, in August of this year, it came back to haunt Dropbox. The breach was much larger than originally believed: over 68 million Dropbox users’ usernames and passwords were compromised. Dropbox has prompted users to reset their passwords if they haven’t done so since 2012.
8. LinkedIn
Like with Dropbox, a 2012 breach came back to haunt LinkedIn. In May this year, 117 million email and password combinations that hackers stole in the 2012 breach became publicly available online. In reaction, LinkedIn invalidated the passwords of all accounts created before the 2012 breach that those users had not reset since.
7. Major Email Providers
In May, Hold Security discovered that over 270 million email usernames and passwords had been given away in the Russian criminal underground. They counted 57 million Mail.ru accounts, 40 million Yahoo! accounts, 33 million Hotmail accounts, and 24 million Gmail accounts. How all of these accounts were stolen remains unknown.
6. Oracle
In August, Brian Krebs uncovered a breach into Oracle, which owns the MICROS point-of-sale system used in over 330,000 cash registers globally. According to Krebs, the most likely culprit was a Russian cybercrime group who had placed malware on company computers and on the MICROS customer support portal in order to steal login credentials.
5. AdultFriendFinder.com
In November, AdultFriendFinder suffered a major attack for the second time in two years. The number of affected users was much greater; the hackers stole the information of about 412 million users and published it online in criminal marketplaces. LeakedSource reported the attack, but AdultFriendFinder did not confirm it.
4. Yahoo!
In September of this year, Yahoo! announced that a hacker had stolen information from at least 500 million user accounts in late 2014. The hacker stole email addresses, passwords, usernames, dates of birth, phone numbers, and even security questions and answers. Yahoo! was working with law enforcement and the FBI at the time of the announcement.
3. KrebsOnSecurity
In September, Brian Krebs’s security blog experienced a DDoS attack more than twice as large as any attack Akamai had ever seen, with peak traffic at around 620 Gbps. The attack methods were unusual, and Krebs later determined that a Mirai botnet consisting of hundreds of thousands of vulnerable IoT devices was responsible.
2. Yahoo! (again)
The only company with two spots on the biggest cyberattacks of 2016, Yahoo! again announced a massive breach in December of this year. They discovered that hackers stole the personal information of one billion user accounts in a 2013 breach. It is now the largest data breach in history.
1. Dyn
And finally, first place in the biggest cyberattacks of 2016. In October, someone used the recently-released Mirai software to build a botnet army of 100,000 infected devices and launch an attack against Dyn. They attacked Dyn’s DNS infrastructure, resulting in the takedown of a good chunk of the internet. Many major websites like Twitter and Etsy, along with many more smaller websites, were inaccessible for hours. October 21 will surely go down in the history books.
To keep up with the latest breaches and read security experts’ comments on them, follow @Plixer on Twitter.