The Biggest Data Breaches in History: What Happened and What We Learned

Data breaches have become so routine that most barely register in the news cycle. But the largest breaches in history — measured by scale, sensitivity of data exposed, or lasting impact on consumers — reveal important patterns about how breaches happen, who is responsible, and what the consequences actually look like. Understanding these incidents isn't just historical curiosity; the data from many of these breaches is still actively circulating and being used in attacks today.

Yahoo (2013–2014): the largest breach by account count. In 2013, attackers compromised all 3 billion Yahoo accounts — every account that existed at the time. In a separate 2014 breach, 500 million additional accounts were exposed. Yahoo didn't disclose the 2014 breach until 2016, and the full scope of the 2013 breach wasn't revealed until 2017 — three years after it occurred. The exposed data included names, email addresses, phone numbers, dates of birth, hashed passwords, and security questions and answers. The delayed disclosure and the sensitivity of security question answers (which are often reused across accounts) made this breach particularly damaging. Yahoo's acquisition price by Verizon was reduced by $350 million as a direct result.

Equifax (2017): the breach that exposed America's financial identity. In 2017, attackers exploited an unpatched Apache Struts vulnerability to access Equifax's systems for 78 days before detection. The breach exposed the Social Security numbers, dates of birth, addresses, driver's license numbers, and credit card numbers of 147 million Americans — roughly 45% of the U.S. population. Unlike a password breach (where you can change your password), SSNs and dates of birth are permanent identifiers that cannot be changed. The Equifax breach created a permanent identity theft risk for nearly half of all American adults. Equifax ultimately paid $575 million in FTC settlements and spent over $1.4 billion on security improvements.

Facebook/Cambridge Analytica (2018): the breach that wasn't technically a breach. Cambridge Analytica harvested the personal data of up to 87 million Facebook users without their knowledge by exploiting Facebook's API, which allowed third-party apps to access not just the data of users who installed the app but also the data of all their friends. No system was hacked — Facebook's own platform was used as designed. The incident exposed how social media platforms' data-sharing practices created massive privacy risks that users had no meaningful way to understand or consent to. Facebook paid a $5 billion FTC fine — the largest privacy fine in U.S. history at the time.

Marriott/Starwood (2018): the breach that started four years earlier. In 2018, Marriott disclosed that attackers had been inside the Starwood Hotels reservation system since 2014 — before Marriott even acquired Starwood. The breach exposed the personal information of up to 500 million guests, including names, addresses, phone numbers, email addresses, passport numbers, dates of birth, and encrypted payment card information. The four-year dwell time — the period between initial compromise and detection — illustrated how sophisticated attackers prioritize persistence and stealth over immediate exploitation. The UK's Information Commissioner's Office fined Marriott £18.4 million under GDPR.

What these breaches teach us: several patterns emerge from the largest breaches. Unpatched vulnerabilities are a common entry point — the Equifax breach exploited a vulnerability that had a patch available for two months. Dwell time is measured in months, not days — attackers prioritize staying hidden over acting quickly. Disclosure is often delayed — companies frequently know about breaches long before they tell consumers. And the data from major breaches doesn't expire — credentials and identity information from breaches years ago continue to fuel fraud today. The practical lessons: freeze your credit (it's free and prevents new account fraud even if your SSN is compromised), use unique passwords for every account, and monitor your credit and identity continuously rather than only after a known breach.