The rate at which companies – large and small alike – are experiencing cybersecurity breaches is alarming. With recent high-profile attacks targeting healthcare, finance, retail, government, manufacturing, and energy, it’s clear that the threat landscape has evolved significantly over the past few years. 

According to projections, cybercrime is forecast to cost the global economy $10.5 trillion by 2025, reflecting a 15% increase year on year. Businesses have never been more vulnerable, and even large enterprises with substantial cybersecurity defenses can fall victim. For smaller businesses, lessons learned from these attacks can help you prepare your security strategy for any eventuality. 

This article discusses some of the most notable company data breaches from recent months, their causes, impacts, and what you should do to remain protected. 

Top 7 Recent High-Profile Company Data Breaches in 2023 

1. Chick-fil-A: March 2023

The popular fast-food joint Chick-fil-A confirmed a data breach of their mobile app that exposed customers’ personal information. The company noticed unusual login activity, investigated the anomaly, and determined the cyber attack happened within the first few months of 2023. The hacker used email addresses and passwords from a third-party to get into the system and acquire info like membership numbers, names, emails, addresses, and more.

Although less than 2% of customer data was breached, Chick-fil-A is already taking measures to prevent any future cyber attacks. The restaurant announced they would increase online security and monitoring, and also reimburse any accounts that suffered from the attack. If you think your account was affected, here is how you can secure your account and get reimbursed for any unauthorized transactions.

2. Activision: February 2023

The video game publisher behind the Call of Duty franchise, Activision, confirmed on February 19th, that they had suffered a data breach back in December. The hacker used an SMS phishing attack on an HR employee to gain access to employee data, including their emails, cell phone numbers, salaries, and work locations.

Activision claims that the attack was addressed swiftly and that there was not sufficient data obtained to warrant alerting their employees directly after the data breach. However, a security research group investigated the breach and reported that the hacker had also gained access to the gaming companies 2023 release schedule, along with the sensitive employee info. Due to California law, if 500 or more employees’ data. is breached, the company must alert the team. Time will tell if the hesitation to alert employees of the issue will result in legal, and possibly financial, trouble.

3. Google Fi: February 2023

Google Fi is the most recent high-profile data breach, but it comes as a consequence of the T-Mobile data breach that happened earlier in 2023 (discussed below). Because Google doesn’t have it’s own network infrastructure and had to piggyback on T-Mobile’s network, they were affected by their massive data breach, compromising their customers’ phone numbers.

Although it’s simply phone numbers, there is a lot cybercriminals can do with that kind of customer information, including phishing attacks intended to deceive users into clicking links that allow the hackers access to other info. If you are a Google Fi user, be extra careful of suspicious messages in 2023.

4. T-Mobile: January 2023

In early January 2023, T-Mobile discovered that a malicious actor gained access to their systems in November last year and stole personal information, like names, emails, and birthdays, from over 37 million customers. Once they identified the data breach, they were able to track down the source and contain it within a day.

T-Mobile claims they may “incur significant expenses” from this data breach, which will be on top of the $350 million they agreed to pay customers in a settlement related to an August 2021 data breach. Not only has T-Mobile lost hundreds of millions of dollars because of their poor security, but they have also lost customers’ trust after multiple breaches of personal information.

5. MailChimp: January 2023

MailChimp, the email marketing platform, alerted customers that they had suffered a data breach due to a social engineering attack that allowed unauthorized users into an internal customer support tool.

The hackers gained access to employee information and credentials, but the company has since identified and suspended those accounts. In response to the data breach, MailChimp has said “Our investigation into the matter is ongoing, and includes identifying measures to further protect our platform”, according to Bleeping Computer.

This is MailChimp’s first attack of 2023, but they also had data breaches in April and August of 2022. It’s important to know what to do after a data breach in order to stop hacking attempts before they compromise information multiple times, as MailChimp now knows.

6. Norton Life Lock: January 2023

Norton Life Lock sent a notice to their customers in mid-January that over 6,000 of their customer accounts had been breached in recent weeks due to a “stuffing” attack. Stuffing attacks are when previously compromised passwords are used to hack in to accounts that use a shared password, another reason why multi-factor authentication is so important.

Gen Digital, Norton Life Lock’s parent company, sent the notice to accounts they believe could have been compromised and recommended changing passwords and enabling two-factor authentication.

7. Uber: December 2022

Uber announced on December 12th, 2022 that a hacker under the pseudonym “UberLeaks” gained access to 70,000+ Uber employees data and was posting stolen corporate data. They believe this data breach occurred because of a third-party vendor, Teqtivity (a tech asset management company) who had their mobile device management compromised.

This attack was unrelated to another data breach they suffered in 2022 when they discovered they were hacked in mid-September after the hacker announced in the companies Slack organization “I am a hacker and Uber has suffered a data breach” followed by several emojis. This caused the company to shut down its internal messaging service and engineering systems in order to get to the bottom of the incident.

The hacker also claimed it could hack into several of the company’s databases, including messaging data. Uber got in touch with law enforcement and found out the hacker compromised an employee’s account. Uber had dealt with a cyber attack in the past and didn’t report it, which led to a legal battle and thousands of dollars in fees. After another big data breach in 2022, they may need to spend more money to upgrade their cyber security.

Other Cyber Security Breaches

Hackers may not just be after customer data, but they may breach a company’s cyber security measures in order to steal other important information.

On August 25th, 2022, Last Pass, a password management provider used by over 30 million people, announced that a third-party had been able to infiltrate their network by accessing a compromised developer account.

Although the security of the company had been breached, they stated that they don’t believe any encrypted customer data had been accessed, but rather the user “took portions of source code and some proprietary LastPass technical information”. This means that no customer data was breached and that Last Pass’s security and encryption measures for their customer’s passwords did its job. Although this cyber security breach has prompted Last Pass to hire third-party investigators and work towards protecting themselves against more breaches in the future.

Companies with the Most Data Breaches in 2023

Some of the most high-profile company data breaches are notorious for their frequency as well as the damage caused. 

Facebook is one of the most popular websites in the world today. However, the company has faced numerous privacy issues over the years. Their most recent attack occurred in 2021, affecting 533 million users. Before that, Facebook was also hacked in 2018 and 2014, leaving 2.2 billion and 50 million people impacted, respectively. 

Yahoo is another infamous victim of back-to-back cybersecurity incidents. The company was hacked in 2013 and 2014, leaving 1 billion and 500 million people affected, respectively. Their most recent attack in 2017 impacted 32 million users. 

Other companies that have experienced repeat data breaches in the recent past include Amazon, Twitter, Microsoft, Uber, AOL, Dropbox, eBay, and more. But why do these companies experience repeat attacks? Here’s a quick overview of three common reasons:

• Old vulnerabilities: It’s not uncommon for a hacker to leave a secret window that they can use to access a company’s systems again after a successful first attempt. Failing to patch these vulnerabilities can lead to a second attack.
• Human error: Employees using weak passwords may expose a company’s systems to subsequent attacks. Other common human errors include employees clicking on malicious links and visiting phishing sites. Unless you perform follow-up security training following an initial breach, employees can repeat previous mistakes that leave your business vulnerable.
• Malware: Hackers use malicious software such as viruses, ransomware, Trojans, spyware, adware, etc., to steal confidential information from an organization’s network system. If a company fails to step up monitoring protocols after its first breach, there is nothing to stop repeat attacks from occurring. 

Don’t Fall Victim to Company Data Breaches

It doesn’t matter if you’re a small business or a large corporation; in 2023, every modern company is at heightened risk of cyber attack. To keep your data secure, you need a comprehensive cybersecurity solution. At Electric, we help businesses protect their most valuable asset from threat actors. Get in touch to learn more about our unified IT security at the device, application, and network levels.