personal data breach
2 articles with this tag
Takufile-bin Data Leak (2019) — Why Plaintext Password Storage Is Fatal, and the Hashing Defense
A server vulnerability was exploited for unauthorized access, and ~4.8 million records — names, emails, login passwords, dates of birth, including withdrawn customers — leaked. The decisive failure was that login passwords were stored unencrypted, in plaintext: leaked, they were immediately usable and fed account-takeover on other sites via password reuse. Defend by storing passwords as a one-way salted hash, holding no data you don't need, patching vulnerabilities, and preparing for reuse (2FA).
Benesse Data Leak (2014) — Why an Insider Couldn't Be Stopped, and the Least-Privilege Defense
A dispatched systems engineer at an outsourced group company used legitimately granted database access to copy customer data in bulk, transfer it to a personal smartphone, and sell it to data brokers. The monitoring software blocked writes to USB storage but did not block transfer to a smartphone (MTP). Up to ~35 million records leaked. Defend by minimizing privilege (least privilege / need-to-know), closing every exfiltration path with DLP, detecting bulk access, and extending oversight all the way to contractors and sub-contractors.