Top 10 Worst Data Breaches in History

Hackers lurked inside Marriott’s Starwood reservation system for four years, eventually stealing 500 million guest records including passport numbers and payment details. While this dwarfs the National Public Data leak in per-record sensitivity — passport data is uniquely damaging — it amounts to 83% fewer total records than the 2.9 billion-event. The breach triggered a £18.4 million fine under GDPR and forced Marriott to overhaul its global cybersecurity infrastructure.

The Facebook/Cambridge Analytica scandal exposed how 87 million users’ data was harvested without consent for political advertising—three times more affected than the 30 million initially reported in the Equifax breach, and impacting 13% of Facebook’s 2018 user base. The data leveraged psychological profiles for 50 million US voters, triggering a global regulatory shift that cost Facebook $5 billion in FTC fines alone.

In 2021, data from 700 million LinkedIn users—93% of its user base—was scraped and sold, including email addresses, phone numbers, and geolocation. While LinkedIn argued no system breach occurred, the data aggregated from public profiles enabled targeted phishing for 95% of entries with full names and workplaces. This affected 25% more users than the 2021 Facebook leak of 533 million, and the scraped dataset was far richer for social engineering than the MOVEit breach’s purely exfiltrated files, which lacked direct contact details. The incident cost LinkedIn an estimated $1.2 million in remediation and legal fees.

The MOVEit breach exploited a zero-day SQL injection flaw, compromising 2,700+ organizations and exposing 93.3 million individuals—over five times more victims than the SolarWinds supply chain attack, which affected 18,000 organizations. The Clop ransomware gang’s data exfiltration method exposed personal data in 94% of impacted entities, a rate 30% higher than typical ransomware incidents. This attack’s scale dwarfs the Facebook/Cambridge Analytica scandal in organizational impact, as MOVEit hit government and enterprise systems globally, with estimated costs exceeding $10 billion in recovery and litigation.

The SolarWinds breach inserted backdoor code into Orion software updates, infiltrating 18,000 organizations including U.S. Treasury and DHS. Attackers maintained undetected access for an average of 9 months—over 2.8 times longer than the typical 95-day dwell time for advanced persistent threats. This espionage-focused attack outranks the MOVEit breach in strategic sophistication, targeting government networks rather than widespread extortion. The breach’s supply chain vector exposed sensitive communications from 100+ federal agencies, with estimated response costs of $100 million for SolarWinds alone.

The 2013 Target data breach marked a significant turning point in cybersecurity, prompting a global re-evaluation of security protocols within major corporations. Threat actors gained access to Target's systems through a compromised HVAC vendor, ultimately exfiltrating 40 million credit card numbers and 70 million customer records, including names, addresses, phone numbers, and email addresses. This incident notably surpassed the 2007 TJX breach, which previously held the record for the largest retail breach with 45.6 million credit and debit card numbers stolen, highlighting the increasing sophistication of cyber threats. In the aftermath, Target faced substantial financial repercussions, including a reported net loss of $292 million and an estimated cost exceeding $200 million.

The Sony PlayStation Network suffered a catastrophic security breach in 2011, leading to a 23-day network outage and the compromise of approximately 77 million user accounts. This extensive downtime significantly damaged Sony's reputation and incurred estimated costs of $171 million for the company. The stolen data included usernames, passwords, and other personal information, with credit card data also compromised, though encrypted.