Interactive · timeline
A history of the breach
The worms, breaches and turning points that shaped how we defend systems today — what happened, why it mattered, and the lesson each one left behind. Filter by type, or see what happened on this day.
- 2026
Klue supply-chain breach
Supply chainAn extortion crew reached data on nearly 200 companies — including security firms — by exploiting a third-party credential issued in 2022 that was never decommissioned.
Lesson Credentials that outlive their purpose become skeleton keys — decommission access as deliberately as you grant it.
Source: TechCrunch ↗ - 2026
Foxconn (Nitrogen ransomware)
RansomwareThe Nitrogen ransomware group claimed to have stolen roughly 8TB from Foxconn’s North American factories, including design and project data tied to major technology customers.
Lesson Manufacturers hold their clients’ intellectual property — one supplier breach can leak the designs of every brand they build for.
Source: TechCrunch ↗ - 2026
Instructure / Canvas
Data breachThe ShinyHunters group breached the Canvas learning platform, stealing data on 30+ million students and staff and defacing login screens during exam season when the ransom went unpaid.
Lesson Modern extortion adds public pressure and disruption on top of theft — plan for the “name and shame” stage, not just recovery.
Source: TechCrunch ↗ - 2026
FBI network intrusion
Nation-stateA breach of an unclassified FBI network reportedly exposed phone numbers linked to federal surveillance targets; US officials attributed the intrusion to Chinese state-sponsored actors.
Lesson “Unclassified” is not the same as low-sensitivity — data can cause real-world harm regardless of its label.
Source: TechCrunch ↗ - 2025
Salesloft Drift → Salesforce
Supply chainA threat group abused OAuth tokens stolen from the third-party Salesloft “Drift” app to reach the Salesforce data of many major firms — turning one SaaS integration into dozens of breaches.
Lesson Every OAuth-connected app is a key to your data — inventory and constrain third-party tokens like privileged accounts.
Source: Infosecurity Magazine ↗ - 2025
SharePoint “ToolShell”
LandmarkAttackers chained two SharePoint zero-days (CVE-2025-53770/53771) to run code on hundreds of internet-facing on-premises servers across government and healthcare before patches were widely applied.
Lesson Internet-facing on-prem collaboration servers are prime targets — exposure plus patch lag equals mass compromise.
Source: Infosecurity Magazine ↗ - 2025
Bybit crypto theft
Nation-stateAttackers subverted a routine cold-wallet transfer at the Bybit exchange and redirected roughly $1.4bn in Ethereum — the largest crypto theft on record — later attributed by the FBI to North Korea’s Lazarus Group.
Lesson Even “cold” signing is only as safe as the interface humans approve on — verify what you sign, not just where the keys live.
Source: Infosecurity Magazine ↗ - 2024
Snowflake customer data theft
Data breachAttackers used stolen credentials to log into many Snowflake customer data-warehouse tenants that had no MFA, exfiltrating huge datasets from a string of well-known companies.
Lesson A cloud data platform is only as safe as the identities in front of it — MFA is not optional.
Source: Wikipedia ↗ - 2024
XZ Utils backdoor
Supply chainA patient multi-year social-engineering campaign smuggled a hidden backdoor into the widely used xz compression library — caught by chance days before it reached mainstream Linux distributions.
Lesson Open-source trust can be attacked through people, not just code: maintainer takeover is a supply-chain vector.
Source: Wikipedia ↗ - 2024
Change Healthcare
RansomwareRansomware against the largest US healthcare payment clearinghouse paralysed claims and prescriptions nationwide for weeks and exposed data on a large share of the US population.
Lesson Concentration risk: when one processor sits behind much of an industry, its outage is everyone’s outage.
Source: Wikipedia ↗ - 2023
MOVEit (Cl0p)
Supply chainA ransomware group mass-exploited a zero-day in the MOVEit file-transfer tool to steal data from hundreds of organisations through a single product.
Lesson One vulnerable third-party product becomes a breach for everyone who uses it.
Source: CISA ↗ - 2021
Log4Shell
LandmarkA trivially exploitable flaw in the ubiquitous Log4j logging library let attackers run code on countless servers by getting a string logged.
Lesson You cannot defend what you don’t know you run — dependency visibility is security.
Source: CISA ↗ - 2021
Kaseya VSA
Supply chainAttackers exploited an IT-management platform to push ransomware to its customers’ customers, hitting well over a thousand downstream businesses at once.
Lesson Management tooling has god-mode reach — compromise it and blast radius is enormous.
Source: CISA ↗ - 2021
Colonial Pipeline
RansomwareA ransomware intrusion (initial access via a single leaked VPN password with no MFA) shut down the largest US fuel pipeline, triggering shortages.
Lesson One credential without MFA can become a national-infrastructure event.
Source: CISA ↗ - 2020
SolarWinds (SUNBURST)
Supply chainAttackers implanted a backdoor into the build pipeline of SolarWinds Orion, distributing it via a signed update to thousands of organisations including US agencies.
Lesson Trust in signed updates is itself an attack surface — verify the pipeline, not just the file.
Source: CISA ↗ - 2017
Equifax
Data breachAn unpatched web-application framework flaw let attackers exfiltrate sensitive records on ~147 million people over months, undetected.
Lesson Asset inventory and patch discipline are existential, not hygiene.
Source: Wikipedia ↗ - 2017
NotPetya
RansomwareDisguised as ransomware but built to destroy, NotPetya spread from a compromised Ukrainian software update into multinationals, causing ~$10bn in damage.
Lesson The most expensive cyberattack in history began as a supply-chain software update.
Source: Wikipedia ↗ - 2017
WannaCry
RansomwareRansomware using a leaked SMB exploit self-spread across unpatched Windows machines worldwide, crippling hospitals and businesses in a single day.
Lesson A leaked exploit plus unpatched systems equals global impact overnight.
Source: Wikipedia ↗ - 2016
Mirai / Dyn
WormThe Mirai botnet enslaved insecure IoT devices and aimed them at DNS provider Dyn, knocking major sites offline across the US.
Lesson Default credentials at IoT scale become internet-scale firepower.
Source: Wikipedia ↗ - 2015
US OPM
Nation-stateThe US Office of Personnel Management disclosed the theft of background-check records on ~21.5 million people, including fingerprints and security-clearance detail.
Lesson Some data can never be “reset” — the impact of its loss is permanent.
Source: Wikipedia ↗ - 2014
Sony Pictures
Nation-stateA destructive intrusion wiped systems and leaked films, emails and employee data, attributed to a nation-state responding to a film’s release.
Lesson Breaches can be about coercion and destruction, not just theft.
Source: Wikipedia ↗ - 2014
Heartbleed
LandmarkA flaw in OpenSSL let attackers read chunks of server memory — keys, passwords, session data — from a huge share of the web, silently.
Lesson Critical infrastructure runs on under-funded open-source; a single library can expose the internet.
Source: Wikipedia ↗ - 2013
Target
Supply chainAttackers entered via an HVAC contractor’s stolen credentials, moved to point-of-sale systems, and stole ~40 million payment cards.
Lesson Your security is only as strong as your least-secured supplier with network access.
Source: Wikipedia ↗ - 2010
Stuxnet
Nation-stateA worm engineered to sabotage Iranian uranium centrifuges by subtly altering their controllers — the first widely documented cyber weapon to cause physical damage.
Lesson Air-gaps are not immunity, and malware can cross from bits into the physical world.
Source: Wikipedia ↗ - 2003
SQL Slammer
WormA 376-byte worm exploiting a Microsoft SQL Server flaw doubled its infected population every ~8.5 seconds, saturating networks globally within minutes.
Lesson Patch latency is a strategy failure — a fix had shipped six months earlier.
Source: Wikipedia ↗ - 2000
ILOVEYOU
WormA Visual Basic email worm with the subject “ILOVEYOU” spread worldwide in hours, overwriting files and mailing itself to every contact.
Lesson Social engineering plus email automation beats technical defences — the human is the fastest attack surface.
Source: Wikipedia ↗ - 1988
The Morris Worm
WormA Cornell graduate student released the first worm to spread across the early internet, disabling an estimated 10% of connected machines by replicating out of control.
Lesson Self-propagating code and the first real reckoning with internet-scale risk — it led to the first CERT.
Source: CISA ↗
No events of that type. Pick another filter.