Top 10 Biggest Cybersecurity Breaches of All Time

National Public Data's 2024 breach exposed 2.9 billion records containing Social Security numbers and addresses, affecting nearly every US citizen. The data was sold on the dark web for $3.5 million, prompting calls for stronger federal regulations. This incident surpasses the 1.1 billion records of the #3 Aadhaar breach, making it the second largest cybersecurity incident by total records, with a scope that threatens identity theft for an entire nation.

India's Aadhaar database breach in 2018 compromised the biometric data of 1.1 billion citizens, with access sold for as little as $7 via WhatsApp. The incident exposed critical flaws in government security design, risking identity theft for over 80% of India's population. Its political impact—undermining trust in national identity systems—outweighs the quantifiable cost of #1 Yahoo's breach, yet the immediate financial damage was far lower per record.

LinkedIn's 2021 scraping incident exposed data from 700 million profiles—92% of users—including emails and salaries, fueling targeted phishing attacks against professionals and costing firms millions in recovery. This dataset is 30% larger than the typical corporate leak, but unlike #2 National Public Data, it contained no Social Security numbers, limiting direct financial fraud risk while still enabling sophisticated social engineering at scale.

The 2019 Facebook breach exposed over 533 million records — phone numbers, account IDs, and personal data — scraped from Meta's systems where it was used for two-factor authentication. When the dataset resurfaced on hacking forums in 2021, it fueled a wave of SIM-swapping attacks affecting users worldwide. Ireland's DPC imposed a €265 million fine, yet this penalty is only fractionally higher than the average GDPR fine for breaches of this scale. The incident remains a stark reminder that even the largest social networks can fail to protect authentication data.

Equifax's 2017 breach is the most costly privacy violation in history, with an unpatched Apache Struts vulnerability exposing Social Security numbers, birth dates, addresses, and credit card details of 147 million Americans. The resulting $575 million FTC settlement is a $75 million increase over the previous largest GDPR fine at the time. Beyond the financial penalty, the incident led to criminal indictments of four Chinese military officers, demonstrating that international cybercrime can carry serious consequences. The scale and resolution of this breach set a benchmark that no other incident on this list has surpassed.

Hackers attributed to Chinese state-sponsored group APT41 maintained access to Starwood's reservation system for four years, exfiltrating 500 million guest records including passport numbers and encrypted payment data before Marriott's $13.6 billion acquisition in 2018. The duration of this attack outperforms #7's timeline by nearly double, as most breaches are detected within weeks. The sheer volume of stolen data — 500 million records — is 40% larger than the runner-up's total on this list. The breach highlights the risks of delayed detection in complex corporate integrations.

The 2020 SolarWinds attack compromised 18,000 organizations, including the US Treasury and Microsoft, through malicious code inserted into Orion software updates by Russian intelligence agency SVR. The supply-chain attack — active for nine months — was called by Microsoft President Brad Smith "the most sophisticated cyberattack ever conducted." Compared to #5's Facebook breach, the SolarWinds incident affected 33 times more organizations and required a $2.8 billion revenue impact to SolarWinds alone. It set a new standard for sophistication in state-sponsored cyberattacks.

The 2021 Colonial Pipeline attack remains the most disruptive ransomware strike on U.S. critical infrastructure, halting operations for six days and triggering gas shortages across the Southeast. The price spike to $3/gallon far exceeded the national average of $2.85 at the time, and the $4.4 million Bitcoin ransom paid to DarkSide—$2.3 million of which was later recovered by the FBI—marks a rare success in ransom retrieval. This breach exposes vulnerabilities that surpass #10 Change Healthcare's healthcare-sector disruption in immediate economic impact, as fuel dependencies rippled faster than prescription delays. The incident set a new benchmark for cyberwarfare targeting vital infrastructure, demonstrating how a single attack could paralyze energy supplies for millions.

The 2024 ransomware attack on UnitedHealth Group's Change Healthcare subsidiary disrupted prescription drug processing across the entire U.S. healthcare system for weeks, affecting 94% of all hospitals—a scale 60% greater than the Colonial Pipeline's regional impact. The $22 million ransom paid to the ALPHV/BlackCat group and the exposure of records for approximately 190 million Americans make it the largest healthcare breach ever, outpacing #9 Colonial's medical data exfiltration by a factor of 180. ALPHV/BlackCat's double extortion tactics proved more sophisticated than DarkSide's, with data leaks amplifying the damage beyond operational shutdowns. This incident highlighted the fragility of centralized healthcare IT, as even a single subsidiary's compromise could paralyze critical infrastructure nationwide.