The Biggest Data Breaches of All Time: What Can We Learn From Them?

Why the biggest data breaches keep happening

The biggest data breaches in history share a pattern: they did not happen because attackers were uniquely brilliant. They happened because defenders left known vulnerabilities unpatched, stored data without encryption, or ran databases with no authentication at all. According to IBM’s Cost of a Data Breach Report, the global average cost of a breach reached $4.88 million in 2024 — and that figure rises every year. Understanding the worst cases on record is the first step toward not becoming one of them.

Cognyte: 5 billion records (2021)

In 2021, Comparitech researcher Bob Diachenko discovered a Cognyte database containing roughly 5 billion records left completely exposed — no authentication, no encryption, accessible to anyone on the internet. The breach was particularly striking given what the database held: records from Cognyte’s previous research into other companies’ data breaches, including leaked passwords, email addresses, and user identities. A cybersecurity analytics firm had failed to secure a database full of other people’s security failures.

Yahoo: 3 billion records (2013–2014)

The Yahoo breach remains the largest single-company data breach in history by record count. Hackers compromised Yahoo’s network in August 2013, copying names, phone numbers, email addresses, hashed passwords, and security questions for every one of the company’s 3 billion user accounts. Yahoo did not disclose the breach publicly until 2016 — and even then understated the impact, claiming only 1 billion accounts were affected. The true scale did not emerge until 2017.

The legal fallout was significant. Yahoo settled a class action lawsuit for over $115 million. Hacker Karim Baratov, who assisted Russian intelligence officers behind the attack, was sentenced to five years in prison and fined $2.25 million. When Verizon acquired Yahoo in 2017, it knocked $350 million off the purchase price after the breach disclosure.

Collection #1 compilation: 2.2 billion records (2019)

In January 2019, a dataset known as Collection #1 surfaced on hacking forums containing 773 million unique email addresses and over 21 million plaintext passwords, compiled from hundreds of earlier breaches including LinkedIn and Dropbox. Later the same month, Collections #2 through #5 appeared, bringing the total to 2.2 billion unique login credentials available for free download via BitTorrent. The compilation illustrates how stolen records compound: a password leaked in a 2012 LinkedIn breach was still being used to compromise accounts years later because millions of users never changed their credentials.

Comcast: 1.5 billion records (2020)

Security researchers discovered a publicly accessible Comcast database in 2020 containing 1,507,301,521 records — email addresses, passwords, and IP addresses for customers of the second-largest US telecommunications company. The database required no credentials to access. Comcast had already faced a 2014 breach exposing personally identifiable information on over 24 million customers after an employee misconfigured a software application, and a 2023 Comcast Xfinity breach later exposed data on nearly 36 million customers, including partial Social Security numbers.

River City Media: 1.3 billion records (2017)

In March 2017, spam operation River City Media accidentally exposed 1.37 billion records through a misconfigured rsync backup. The leaked data included names, physical addresses, IP addresses, and email addresses. What made the breach especially damaging was what else the backup contained: internal documentation revealing the company’s IP hijacking and illegal spamming operations. Researchers at Spamhaus and MacKeeper called it one of the largest spam infrastructure exposures on record.

What can we learn from these data breaches?

Every breach above was preventable. The failure modes break down into four categories, each with a direct fix:

• Unpatched software: The 2017 Equifax breach — which exposed 147 million Americans’ personal data — exploited an Apache Struts vulnerability the company had known about for two months. Patch critical vulnerabilities within 24 hours of public disclosure.
• Missing authentication: Cognyte and Comcast both exposed databases accessible without any login credentials. Require authentication and access controls on every data store without exception.
• Delayed disclosure: Yahoo waited three years to notify affected users. Most jurisdictions now require notification within 72 hours of discovering a breach. Delayed disclosure compounds both legal liability and reputational damage.
• No multi-factor authentication: MFA would have blocked or significantly slowed the credential-stuffing attacks behind the Collection #1 campaign. It is one of the highest-impact, lowest-cost controls available to any organization.

Investing in the right expertise also matters. The demand for cybersecurity specialists has grown precisely because these failures keep recurring at organizations of every size. Zero-trust architecture — which requires verification at every access point regardless of network location — addresses all four failure modes at once. If you are also securing personal digital assets, our guide on cryptocurrency security best practices covers zero-trust principles applied to personal finance.

Frequently asked questions

What was the biggest data breach in history?

By single-entity impact, the Yahoo breach from 2013 to 2014 remains the largest, affecting all 3 billion Yahoo user accounts. By total records aggregated across multiple sources, the 2024 Mother of All Breaches (MOAB) compilation contained 26 billion records drawn from thousands of prior incidents.

What are the main causes of massive data breaches?

Three root causes account for the majority of large-scale breaches: misconfigured databases left accessible without authentication, unpatched software vulnerabilities, and human error. IBM’s 2024 research attributes 95% of breach incidents to at least one preventable human or process failure.

How much does a data breach typically cost a company?

The global average cost per breach reached $4.88 million in 2024, according to IBM’s Cost of a Data Breach Report. In the United States the average exceeds $10 million per incident. Healthcare has been the most expensive sector for more than a decade, averaging over $10.9 million per breach.

Can data scraping be considered a data breach?

Technically yes, though platform operators often classify it as a terms-of-service violation. Large-scale scraping — such as the 2021 Facebook incident exposing 533 million user records — still results in exposed personal data that enables phishing and identity theft, regardless of how the platform labels it.

What are the top lessons from the biggest data breaches?

Four controls prevent the majority of large-scale breaches: patch known vulnerabilities immediately, require authentication on every data store, enforce multi-factor authentication across all accounts, and segment your network so a single compromised server cannot access the entire database.