The aftermath: An analysis of recent security breaches

Every cybersecurity professional, no matter their role, knows that the worst-case security scenario for their employer is a security breach. However, with attacks and threats becoming more advanced and evolving, even experienced professionals at some of the world’s most successful organizations can fall victim to a cybersecurity breach.  

Seeing new breaches in the headlines can seem a little discouraging at first, but learning more about the extent of these attacks, how they occurred and how some of the most successful security practitioners in the business deal with the aftermath can give you valuable insights for your education or career. 

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

• Date of breach: December 2021
• Type of breach: Data breach caused by API vulnerability
• Total users affected: 5,485,635 

Due to a zero-day vulnerability that was exploited by a threat actor, over 5.4 million global Twitter users had their profile information illegally acquired, which was then sold to two other threat actors. The vulnerability was patched in January 2022, but by then, the email accounts and phone numbers of those users had already been exposed.  

Though there were no specific instances noted, the phone numbers and email addresses of those users were left open to spearphishing attacks, and those using pseudonyms or trying to remain anonymous on the social media platform had their real identities exposed. Any high-profile or celebrity users affected in the zero-day security breach also had their private information exposed.  

• Date of breach: December 29, 2022
• Type of breach: Cyber attack resulting in code breach
• Affected: Slack employee tokens

In this security breach, a threat actor was able to violate the security of Slack’s GitHub account and download a subset of their private code. They did this by stealing Slack employee tokens used to access GitHub, but luckily, no primary code or user data was accessed in this hack. In response, Slack invalidated all their employee tokens for GitHub and reissued new ones. 

Slack’s response to the hack was considerably quiet, as it came on the heels of an incident in August of the same year, where password hashes were accidentally leaked by the company. 

In response, Deezer assured its users that, despite the third-party hack, their systems and databases remained secure. They informed their customers of the type of data leaked in the recent breach and recommended that they change their passwords to increase account security despite no reported leaked passwords.

They also reassured users and regulators that they did their due diligence when working with the unnamed third party, including vetting ISO 27001 and SOC 2 certifications, engaging in GDPR-compliant data protection agreements and obtaining certificates of data destruction. The security breach was never reported to Deezer by the third-party provider. 

Common themes and lessons learned 

These are just a small sample of recent breaches, but they highlight the various ways an organization can be breached — from zero-day exploits to insecure databases to third-party partners. Strengthening your organization’s network and information security is vital but ultimately not very useful if third-party service providers with access to your data don’t have a secure information security model in place. Auditing the security of companies you share data with can help you make informed decisions about whom to keep working with.

Another theme is the awareness and response each of these organizations had. The majority weren’t aware of a breach or vulnerability until it was brought to their attention by a user, a cybersecurity firm or the threat actor themselves. Creating a path for researchers and others to report issues can ensure those issues get addressed — before it becomes a messy breach.

Cybersecurity breaches often lead to significant issues, including legal and compliance issues, downtime, loss of customer trust, monetary fines and reputational damage. Creating response plans for various breach scenarios so you can be proactive rather than reactive can help shape public perception of the incident. 

If you want to explore more breaches, check out the articles linked below.