The cyber risk panorama in Europe continues to evolve, with cyber assaults concentrating on a number of establishments throughout the EU. The worrying facet is that many breaches additionally go unreported, as European companies typically don’t report an incident for worry of their popularity being tarnished and as an alternative decide to handle the fallout internally.
With the GDPR (Normal Knowledge Safety Regulation) handing out file quantities of fines, it’s as much as European companies to rapidly assess their cybersecurity capabilities and implement insurance policies and protections sufficient sufficient to fulfill worldwide information safety requirements.
It’s essential for companies to study from as many incidents as doable to collectively enhance their information safety and information privateness practices, in addition to acquire perception on how one can stop information theft. This text will embrace an inventory of the most important information breaches in Europe up to now, how companies have been affected, and the way they might have prevented the problems.
Prime 21 Largest Knowledge Breaches in Europe
Here’s a record of the highest information breaches to happen in Europe:
1. British Airways
Date: June 2018 – September 2018
Impression: 380,000 to 500,000 clients
The ICO (Info Commissioner’s Workplace), an equal of Europe’s DPC and the physique that upholds information privateness legal guidelines within the UK, confirmed the assault after noticing the airways’ web site was diverted to a false hackers’ website.
In keeping with information safety consultants, a provide chain assault on third-party cost providers on the British Airways’ web site was used through a malicious JavaScript code injection that siphoned cost information to unknown attackers. This methodology has been confirmed judging by how the compromised information included CVV codes that, in line with PCI-DSS requirements, weren’t saved however processed when funds have been made, which rendered database entry unlikely.
The ICO issued a £183 million high-quality, the most important high-quality levied as of 2018, however in October 2020, British Airways ended up paying a considerably decrease sum of merely £20 million ($26 million) for failing to guard the non-public data and monetary information of shoppers and affected information topics.
2. European Central Financial institution
Date: July 2014
The ECB would later undergo a malware assault in 2018, by which contact data for 500 subscribers was stolen because the Banks’ Built-in Reporting Dictionary (BIRD) was hacked.
3. PrivatBank
Date: July 2014
Impression: 40 million data
In July 2014, Ukraine’s PrivatBank was hacked by a pro-Russian hacker group, CyberBerkut, that stole and printed buyer information (together with banking data, passport data, and private information), then posted the stolen content material on the Russian social media platform VKontakte. The safety breach uncovered over 40 million data of the financial institution’s clients.
The hacker group warned the financial institution’s clients emigrate their transactions to state-owned banks. Allegedly, the motives of the cyber assault have been state-sponsored, because the assault was prompted after PrivatBank’s co-owner, Igor Kolomoisky, positioned a $10,000 bounty on Russian saboteurs in Ukraine. The hacker group appears to have sought retaliation for the order.
Nonetheless, ultimately, no pro-Russian connections have been discovered. Native cybersecurity consultants declare that the cyber assault methodology was deemed unsophisticated by Russian requirements.
4. Latvian State Income Service
Date: February 2010
Impression: 7.5 million monetary information and tax data of state staff
In February 2010, an unknown hacker leaked confidential data from the Latvian State Income Service. Roughly 7.5 million tax data, monetary data, and salaries of state staff have been leaked periodically to Twitter and a Latvian TV station.
The perpetrator was found to be Ilmars Poikans, aka”‘Neo,” part of the “Fourth Awakening People’s Army” hacker group, who was arrested and sentenced in 2015. The hacker’s motive was to show the excessive salaries of state staff in a one-man whistleblowing operation throughout a interval when Latvia had excessive unemployment and poverty charges.
Moreover cost particulars of financial institution managers and dear bailouts, no different confidential data was leaked. This propelled the Latvian IT researcher right into a “Robin Hood” cult standing stage of recognition.
In the end, the Latvian Supreme Court docket pardoned Poikans in December 2017, and a while afterward, he was sentenced to 100 hours of group service.
5. Warsaw Inventory Alternate
Date: October 2014
Impression: 30,000 units of investor login credentials
In October 2014, a suspected ISIS hacker group hacked the networks of the Warsaw Inventory Alternate and rendered their web site unavailable for 2 hours.
Furthermore, the group additionally stole server IP addresses and infrastructure maps of WSN (wi-fi sensor networks), which confirms that they efficiently gained unauthorized entry. The alternate’s officers, although, claimed that the buying and selling system was not compromised.
First believed to be affiliated with ISIS mercenaries, the hacker group posted a observe on the inventory alternate’s web site stating that the cyber assault was a retaliation for Poland’s involvement in bombing the Islamic State areas in Iraq and Syria.
Nonetheless, NATO officers claimed that the group was really associated to APT 28, a Russia-backed group of cybersecurity consultants allegedly related to the GRU.
There isn’t a data as to how the hacker group accessed the inventory alternate’s networks. The one identified truth is that they exploited a vulnerability within the alternate’s internet portal that served as a prototype for a brand new buying and selling platform. On the identical time, additionally they infiltrated the inventory alternate’s public funding simulator.
6. Well being Service Govt of Eire
Date: Might 2021
Impression: 520 sufferers and HSE workers, stolen confidential company information, a whole shutdown of HSE native and nationwide networks
On Might 14, 2021, one in every of Eire’s largest medical techniques, the Well being Service Govt (HSE), suffered a serious ransomware assault, the biggest identified safety incident towards an Irish state company system up to now. The assault disrupted the IT techniques of a number of Irish hospitals and encrypted their database, forcing them to return to utilizing paper-based data.
The hacker group that launched this cyber assault was recognized to be the Russian-based “Wizard Spider” hacker group, which demanded €16.5 million to decrypt the information and never expose the information to the general public. In keeping with the Nationwide Cyber Safety Centre, the perpetrators used the penetration testing instrument Cobalt Strike to contaminate the HSE’s techniques and a quick and complicated ransomware sort often called Conti to encrypt an unknown quantity of knowledge and medical data.
The Irish authorities warned that the stolen medical data could be bought to different criminals to defraud and blackmail the sufferers. A wide range of information was stolen, together with:
Private dataMedical recordsHSE company and administrative dataCommercial information
Cybersecurity consultants remarked that the HSE’s IT infrastructure was dangerously outdated, with 80,000 of the gadgets linked to the HSE’s central servers nonetheless working on Home windows XP. Moreover, a overview of the healthcare system discovered that the system was extraordinarily fragmented, with dozens of well being boards, hospital teams, and group organizations working on a number of techniques.
By the top of September, 5 months after the incident was found, at the very least 95% of the HSE’s techniques have been efficiently decrypted and restored. The Chief Govt of the HSE, Paul Reid, estimated that the price of the cyber assault would exceed €600 million.
7. COSMOTE Cellular Telecommunications
Date: September 2020
Impression: 4.8 million clients, 48 GB of knowledge stolen
Greece’s largest cell operator, Cosmote Cellular Telecommunications, suffered a social engineering assault in September 2020 by which clients’ private information was uncovered.
Upon additional investigations, it was revealed that the agency had been illegally processing buyer information in line with GDPR necessities. The compromised information wasn’t absolutely encrypted, which enabled hackers to determine clients from the stolen information. Moreover, COSMOTE did not notify the affected subscribers of the information breach as required by the GDPR.
In complete, the positional information and private particulars of subscribers, together with listing information from nearly 7 million customers from different suppliers that communicated with COSMOTE subscribers, have been uncovered.
In the end, The HDPA (Hellenic Knowledge Safety Authority) fined COSMOTE Cellular Telecommunications €6 million for a number of violations. Moreover, the OTE group, COSMOTE’s dad or mum firm, was additionally fined €3.25 million for incomplete safety measures and failing to implement the required cybersecurity infrastructure to forestall information safety breaches, as reported by Greek media.
8. Bulgarian Nationwide Income Company
Date: July 2019
Impression: 5 million citizen data, 21 GB of knowledge
In August 2019, the Bulgarian NRA (Nationwide Income Company) suffered an information breach involving the delicate data of roughly 5 million residents, Bulgaria’s greatest private information breach up to now. It was suspected that hackers used a SQL injection assault to infiltrate techniques. The information that was leaked included:
Wage and income recordsNational identification numbersTax paymentsSocial safety informationPersonal debt informationHealth and pension paymentsUser data from on-line playing web sites
The Bulgarian DPA (Knowledge Safety Authority), Bulgaria’s major information safety authority, issued the NRA a €2.6 million high-quality (5.1 million Bulgarian leva) for failing to take the mandatory steps and measures to guard private information and failing to conduct a correct danger evaluation of their information processing operations. Moreover, a part of the 11 GB of stolen delicate information was leaked on varied media platforms in Bulgaria.
The investigation additionally revealed that Bulgarian officers didn’t take the incident significantly and did not take enough motion to restrict the assault. Moreover, the International Discussion board on Transparency and Alternate of Info for Tax Functions stopped exchanging data with Bulgaria, which included international locations like Switzerland, Germany, Singapore, and extra.
9. Dutch authorities
Date: March 2020
Impression: 6.9 million data of registered organ donors
Unknown thieves stole two arduous drives from the vault storage of the Dutch authorities that contained the non-public information of roughly 6.9 million registered organ donors, nearly half of the inhabitants of the Netherlands.
In keeping with officers from the Dutch Ministry of Well being, the drives included digital copies of the donors’ ID numbers, names, gender, signatures, and call particulars from the Dutch Donor Register between February 1998 and June 2010.
Dutch authorities state that the 2 discs went lacking when workers started to purge outdated paper types and take away digital data, which have been final utilized in 2016. The authorities reassure that it’s unlikely that the information will probably be used for fraud, as there aren’t any copies of full IDs, and no proof of exploits surfaced on the darkish internet or on-line boards.
10. Kingfisher Insurance coverage
Date: October 2022
UK’s Kingfisher Insurance coverage states that their IT techniques have been penetrated by the notorious ransomware cartel LockBit, with Kingfisher promptly shutting the servers down after figuring out the cyber incident. The cybercriminals acknowledged that they’d efficiently obtained 1.4 TB of firm information, together with buyer information and worker particulars.
Afterward, Kingfisher’s IT workers rapidly blocked exterior entry and shut down servers after the cyber assault. A Kingfisher spokesperson additionally made a press release that safety measures had already been put in place and have been in a position to mitigate any vital affect from the incident.
11. Scottish Environmental Safety Company (SEPA)
Date: December 2020
Impression: 1.2 GB of knowledge (over 4000 recordsdata)
At precisely 00:01 on Christmas Eve, 2020, SEPA (Scottish Environmental Safety Company) suffered a ransomware assault by the Conti ransomware group, shutting off techniques, impacting inner controls, and demanding a ransom to unlock the techniques.
The recordsdata that have been stolen included:
Enterprise data (website permits, authorizations, enforcement notices, company plans)Procurement informationProject informationStaff and worker data
On January 22, the group printed roughly 4,000 information recordsdata on the darkish internet at no cost after the company refused to pay the ransom. Senior management from SEPA acknowledged {that a} full restoration would take vital time, cash, and sources to attain. In response, SEPA rebuilt its IT system structure from the bottom up, accelerating beforehand already-in-place plans to reform its IT techniques.
12. Norfund
Date: March 2020
Impression: $10 million misplaced
Norfund states that the hackers manipulated communications, impersonated licensed workers to make funds, and falsified confidential data, paperwork, and cost particulars between a borrowing establishment and the funding fund.
The hackers cunningly mimicked their use of language with out inflicting suspicion between events and efficiently intercepted the $10 million mortgage deliberate for a Cambodian microfinance establishment. The cash was despatched to a Mexican checking account with the identical identify because the Cambodian establishment.
Norfund teamed with PwC, native authorities, and the Norway Ministry of International affairs to determine the criminals and get well the cash. Nonetheless, it’s unclear if the cash was recovered.
13. Loqbox
Date: February 2020
Impression: Unspecified quantity of buyer monetary information
UK credit score rating builder and monetary establishment Loqbox was the sufferer of a “complex and sophisticated” information breach on February 20, 2020. Though the supply and methodology of the breach have been unspecified, Loqbox was criticized for delaying notifications to affected clients for over per week after discovering the incident.
The compromised information included:
NamesAddressesUser account detailsDates of birthEmailsPhone numbersIncomplete checking account numbersPayment card dates
LoqBox acknowledged that the purchasers’ funds are safe and unaffected, however there’s an opportunity that the primary six and final 4 bank card digits may additionally be compromised and utilized in phishing scams. Though Loqbox acknowledged the assault and supplied sources for buyer safety, additionally they mentioned there can be no compensation supplied for misplaced information.
14. Travelex
Date: December 2019
Impression: 5 GB of buyer information, $2.3 million ransom
London-based international alternate firm big, Travelex, was a goal of a Sodinokibi ransomware assault, with perpetrators demanding $6 million to revive their techniques again on-line.
In keeping with reviews, the cyber attackers used an unpatched VPN exploit to entry Travelex’s techniques, steal 5 GB of buyer information, and execute a ransomware assault by disrupting operations. The hackers additionally threatened to publish the compromised buyer information if their calls for weren’t met inside two days.
The assault affected the agency’s alternate providers that branched between main banks, like Barclays and Lloyds, who used Travelex’s providers. In complete, Travelex techniques have been down for almost two weeks and skilled enterprise disruptions for greater than a month after the incident.
It was reported that Travelex ultimately caved to calls for and paid the Sodinokibi felony group $2.3 million in Bitcoin to get well their information. Nonetheless, simply seven months later, Travelex introduced they needed to lay off 1309 staff on account of the assault.
15. Cayman Nationwide Financial institution (Isle of Man)
Date: November 2019
Impression: 2 TB of knowledge
The Cayman Nationwide Company introduced that the information theft was contained throughout the Isle of Man department and didn’t have an effect on the primary Cayman Nationwide Financial institution operations or techniques.
The group Phineas Fisher launched a manifesto shortly after, saying they “robbed a bank to give the money away” and even provided a $100,000 reward to different hackers to observe go well with and steal high-profile company paperwork. It’s unclear if Cayman Nationwide Financial institution clients have been affected by the information breach.
16. Binance
Date: October 2022
Impression: $570 million stolen
Binance, the world’s greatest cryptocurrency alternate Binance suffered a $570 million token theft in a sequence of assaults concentrating on blockchain vulnerabilities. The vulnerability allowed hackers to forge transactions and create 2 million faux BNB tokens on the community, valued at $570 million.
Nonetheless, Binance was in a position to rapidly include the scenario and notified the community validators to droop operations. Nonetheless, roughly $100 million of funds remained unrecovered. Current Binance clients have been largely unaffected as a result of the tokens have been falsely generated moderately than stolen from accounts. However, the hack represented rising uncertainty within the security of the cryptocurrency world.
17. Wonga
Date: April 2017
Impression: 245,000 customers
Wonga, a payday mortgage agency primarily based within the UK, suffered an information leak that affected as much as 245,000 clients. The uncovered person information included names, addresses, checking account numbers, the final 4 digits of cost card numbers, and kind codes. On high of that, an extra 25,000 customers from Poland have been additionally affected.
Though Wonga didn’t launch the strategy of assault and the way the breach occurred, they don’t consider accounts have been compromised. Doubtlessly affected clients have been suggested to alter the passwords on their accounts.
18. Evercore
Date: December 2018
Impression: 160,000 information objects
An Evercore consultant acknowledged that there was no proof that the information was publicly discovered or misused, claiming that the perpetrator almost certainly sought to realize entry to the administrator’s deal with ebook for additional phishing makes an attempt.
19. Tesco
Date: November 2016
Impression: 40,000 financial institution accounts compromised, £2.26 million stolen from 9000 financial institution accounts
In November 2016, UK-based retail financial institution Tesco suffered a card information theft after thieves exploited vulnerabilities of their card issuing process, permitting them to simply guess card numbers. The unknown criminals managed to extract £2.26 million from roughly 9,000 clients, roughly making up 6% of the financial institution’s buyer base.
In keeping with cybersecurity consultants, the attackers utilized an algorithm to generate doable mixtures to match Tesco’s starting figuring out numbers, exploiting Tesco’s sequential card quantity deficiency. Moreover, the financial institution was discovered to produce other catastrophic safety flaws, similar to its debit card design and defective authorization system.
For failing to fulfill safety requirements and deficiency of their financial institution card coverage, the UK’s Monetary Conduct Authority (FCA) fined Tesco £33 million. As a result of Tesco cooperated with the FCA, the penalty was later diminished to £16.4 million. Tesco additionally reimbursed any affected clients and compensated them for the inconvenience whereas additionally promising to implement enhanced safety measures.
20. Japanese European banks
Date: December 2018
Impression: Tens of hundreds of thousands of {dollars} in stolen funds
A number of Japanese European banks have been the goal of a sequence of bizarre cyber assaults that concerned linked digital gadgets that have been discovered contained in the banks. Hackers associated to the DarkVishnya financial institution heist focused at the very least eight banks to steal tens of hundreds of thousands of {dollars}.
The hacker group bodily accessed premises to attach USBs, laptops, and different digital gadgets to scan the financial institution’s native community. They then discovered entry to public shared folders and internet servers and logged themselves into the banks’ techniques, in the end infecting the system with malware.
Allegedly, the group had disguised themselves as potential staff trying to find a place to realize entry to the financial institution’s bodily premises the place techniques are current. As soon as they accessed the financial institution’s infrastructure, the attackers might provoke withdrawals utilizing international ATMs linked to the financial institution’s cost processor. In addition they used stolen credentials to quickly bypass danger scores and overdraft limits to concurrently make money withdrawals.
The precise variety of the entire damages, stolen information, and stolen cash are unknown, however the assaults might have transferred funds and prompted estimated damages of as much as tens of hundreds of thousands in US {dollars}.
21. Allianz Life Insurance coverage Firm
Date: July 2025
Impression: Over 1 million folks in danger, delicate information misplaced on a majority of shoppers
The insurance coverage big, which operates throughout Europe, confirmed a cyberattack that resulted within the lack of delicate buyer information.
The assault occurred when an unauthorized actor accessed a third-party Buyer Relationship Administration (CRM) system the corporate makes use of. The incident highlights the rising dangers related to third-party vendor relationships.
