personal data breach
2 articles with this tag
Takufile-bin Data Leak (2019) — Why Plaintext Password Storage Is Fatal, and the Hashing Defense
A server vulnerability was exploited for unauthorized access, and ~4.8 million records (names, emails, login passwords, dates of birth, including withdrawn customers) leaked. The decisive failure was that login passwords were stored unencrypted, in plaintext. Once leaked, they were immediately usable and could be used for account takeover on other sites where people reused them. Defend by storing passwords as a one-way salted hash, holding no data you don't need, patching vulnerabilities, and preparing for reuse (2FA).
Benesse Data Leak (2014) — Why an Insider Couldn't Be Stopped, and the Least-Privilege Defense
A dispatched systems engineer at an outsourced group company used legitimately granted database access to copy customer data in bulk, transfer it to a personal smartphone, and sell it to data brokers. The monitoring software blocked writes to USB storage but did not block transfer to a smartphone (MTP). Up to ~35 million records leaked. Defend by minimizing privilege (least privilege / need-to-know), closing every exfiltration path with DLP, detecting bulk access, and extending oversight all the way to contractors and sub-contractors.