Speaker 1: Welcome to tech Stuff, a production from iHeartRadio. Hey there,
Speaker 1: and welcome to tech Stuff. I'm your host Jonathan Strickland.
Speaker 1: I'm an executive producer with iHeart Podcasts and how the
Speaker 1: tech are you? So? In our last episode, I started
Speaker 1: covering some of the largest data breaches in US history,
Speaker 1: and as a refresher, I'm using a list that was
Speaker 1: compiled by Kyle Chen of upguard dot com, and you know,
Speaker 1: biggest data breaches. That's an interesting adjective biggest, because the
Speaker 1: scope of the attack isn't always a case where the
Speaker 1: data breach affected more people than, say, the previous one
Speaker 1: on the list. There are cases in which fewer people
Speaker 1: were affected, but the types of information made the breach
Speaker 1: more severe. For example, in our last episode, I talked
Speaker 1: about al hackers stole information from millions of FriendFinder Networks customers.
Speaker 1: So friend Fighter Networks op rates lots of different businesses,
Speaker 1: including some that fall into the adult entertainment and adult
Speaker 1: lifestyle categories. So for some customers, the revelation that they
Speaker 1: were patronizing such a business could be embarrassing or damaging
Speaker 1: due to the taboo nature of the services, and so
Speaker 1: they're less likely to put up a big fuss about
Speaker 1: a data breach, because if they did, it would be
Speaker 1: admitting that they were using the service. And if you're
Speaker 1: a hacker, that kind of target is really tempting because
Speaker 1: your victims are incentivized to not come forward. Now, we
Speaker 1: left off in the last episode talking about the Cambridge
Speaker 1: Analytica scandal with Facebook. That scandal was a doozy and
Speaker 1: was hitting right around the time when Facebook, now known
Speaker 1: as Meta, was in the US government's crosshairs for multiple reasons.
Speaker 1: In fact, I'd argue that those events are in part
Speaker 1: what led to Facebook changing its name to Meta in
Speaker 1: the first place. It was an attempt to kind of
Speaker 1: distance itself from a brand that was being associated with
Speaker 1: lacks security and other shady maybe not shady shade is
Speaker 1: the wrong word, but ethically questionable actions. But as I
Speaker 1: mentioned in the last episode, the Cambridge Analytica scandal was
Speaker 1: just a little side quest in the real Number five
Speaker 1: on our top ten list of largest data breaches in
Speaker 1: US history. Chen's main target for number five was just
Speaker 1: Facebook in general, because the site has been a massive
Speaker 1: target for hackers looking to harvest a mountain of data,
Speaker 1: and that makes sense. Most estimates put the number of
Speaker 1: Facebook users in the neighborhood of three billion people billion
Speaker 1: with a B. So, if you're a hacker and if
Speaker 1: your goal is to steal as much personal information as
Speaker 1: you can, you're likely balancing a few different things when
Speaker 1: you're figuring out who you're going to attack. How valuable
Speaker 1: is the information you're going to get hold of. How
Speaker 1: much of that information do you think you can potentially
Speaker 1: get away with? How secure is the system? You know
Speaker 1: you might be able to infiltrate a relatively small target
Speaker 1: without much trouble. On the flip side, you're not likely
Speaker 1: going to end up with a ton of useful stuff
Speaker 1: in the process. But Facebook, well, Facebook has just about
Speaker 1: everyone's data on it, and heck, if you wanted to
Speaker 1: see if you could compromise specific accounts and use those
Speaker 1: to boost a misinformation campaign, that's a possibility too. It
Speaker 1: may be that you're not looking to sell information. You
Speaker 1: may want to sell a narrative, and in doing so,
Speaker 1: what you're doing is borrowing accounts that aren't yours to
Speaker 1: elevate a message. The main data breach that Chen mentions
Speaker 1: with Facebook actually happened with Facebook in twenty twenty one.
Speaker 1: You know, that's years after the Cambridge Analyticus scandal, and
Speaker 1: that's when someone posted to a black market site on
Speaker 1: the dark Web that they had data records including personal
Speaker 1: information of more than half a billion Facebook users, so
Speaker 1: more than five hundred million, like five hundred and thirty
Speaker 1: million user accounts essentially, so this information would include things
Speaker 1: like user names, the actual names, the data, birth location data,
Speaker 1: and more, all from people who were on the platform
Speaker 1: between twenty eighteen to twenty nineteen. How much data was
Speaker 1: available per person depended upon the individual and the settings
Speaker 1: that they used on Facebook, because this was another case
Speaker 1: of hackers using data scraping tools to pull publicly available
Speaker 1: information off a platform. So no different than if you
Speaker 1: were to visit each person's account and then just note
Speaker 1: down all the information that was visible to you. And
Speaker 1: you might remember from our last episode that a hacker
Speaker 1: with a handle Tomliner was offering similar information that someone
Speaker 1: presumably Tomliner themselves whoever they are, had scraped off of LinkedIn.
Speaker 1: So this Facebook instance is a similar case, except it
Speaker 1: appears that the hacker exploited a vulnerability in the Facebook
Speaker 1: platform to harvest information from profiles. Until Facebook fixed the
Speaker 1: vulnerability in late twenty nineteen, and this is based off
Speaker 1: Facebook's own statements about the data reach. The company claimed
Speaker 1: initially that the April twenty twenty one data was the
Speaker 1: same as a similar breach that happened in January, also
Speaker 1: of twenty twenty one. Now Motherboard reported in January twenty
Speaker 1: twenty one that quote a user of a low level
Speaker 1: cyber criminal forum is selling access to a database of
Speaker 1: phone numbers belonging to Facebook users and conveniently letting customers
Speaker 1: look up those numbers by using an automated Telegram bot
Speaker 1: end quote. So this person had created a database in
Speaker 1: which you could search for specific names and see if
Speaker 1: you've got a hit with a relevant phone number. But
Speaker 1: the April revelation showed more than just phone numbers, which
Speaker 1: you know already. Just the phone numbers is bad enough,
Speaker 1: But the hack that happened later in twenty twenty one
Speaker 1: included lots more stuff like that geolocation data if it
Speaker 1: was in fact part of the account. Now companies like
Speaker 1: Meta Slash Facebook typically have policies prohibiting the mass scraping
Speaker 1: of data. As I said in the last episode, data
Speaker 1: is effectively the currency of the Internet, and when you
Speaker 1: really get down to it. User data is the commodity
Speaker 1: that Meta relies upon for its revenue. Meta's whole business
Speaker 1: model is primarily centered on advertising, and user data allows
Speaker 1: Meta to work with ad companies to target specific customer bases.
Speaker 1: So you'd better believe Meta would prefer to maintain dominion
Speaker 1: over that information rather than having someone else get a
Speaker 1: hold of it. Plus, by not keeping user information under
Speaker 1: tight control, Meta opens itself up to lawsuits and regulatory
Speaker 1: finds that sort of thing, and that certainly happened in
Speaker 1: twenty twenty one. So, for example, the Data Protection Commission
Speaker 1: or DPC, which is a regulatory agency in Ireland and
Speaker 1: thus part of the European Union, found Facebook at fault
Speaker 1: for failing to comply with the quote GDPR obligation for
Speaker 1: data protection by design and default in the quote. So
Speaker 1: as a quick reminder for those of y'all who live
Speaker 1: outside the EU like me, GDPR stands for General Data
Speaker 1: Protection Regulation and it's part of a much larger piece
Speaker 1: of legislation regarding fundamental rights. So here in the United
Speaker 1: States we have relatively little protection with regard to our
Speaker 1: private information. That may be changing, but it's long overdue.
Speaker 1: The same is not true in the EU, where citizens
Speaker 1: are supposed to have authority over their own personal information.
Speaker 1: In the wake of hackers releasing personal information about more
Speaker 1: than five hundred million Facebook users, the DPC conducted an
Speaker 1: investigation into Facebook. The DPC determined that Facebook failed to
Speaker 1: embed proper data privacy and protection measures in place, and
Speaker 1: that gave the hackers the opportunity to scrape all that data.
Speaker 1: So just having a policy saying hey, don't do that,
Speaker 1: that wasn't enough. They had to have things that actually
Speaker 1: would prohibit the practice, and that was where the failure was.
Speaker 1: The DPC then ruled that Facebook would owe a fine
Speaker 1: of two hundred and sixty five million euros, which at
Speaker 1: the time equalled to around two hundred and seventy five
Speaker 1: million dollars, And that was actually the third fine DPC
Speaker 1: levey to get Meta just that year. The first fine
Speaker 1: was for eighteen point six million dollars that related to
Speaker 1: Meta keeping really poor records that contributed to a data
Speaker 1: leak that exposed the information of around thirty million Facebook users,
Speaker 1: so a much smaller leak in that case. The second
Speaker 1: of the fines was actually the largest because this two
Speaker 1: hundred and sixty five million euros. That wasn't the most.
Speaker 1: The most was four hundred two million, and that had
Speaker 1: to do with how Facebook, well really Meta was handling
Speaker 1: data that belonged to teenage users of the app Instagram.
Speaker 1: So yeah, it was a very expensive year for Meta
Speaker 1: in terms of fines paid to the EU. I mean
Speaker 1: keep in mind that Facebook had also had to face
Speaker 1: a five billion dollar fine in the United States earlier
Speaker 1: due to other issues. So yeah, Facebook was no stranger
Speaker 1: to having to pay out hundreds of millions and even
Speaker 1: billions of dollars in fines for how the company handles information.
Speaker 1: In Chen's blog post, he also points out a few
Speaker 1: other incidents involving Meta and data security or lack of
Speaker 1: data security. So, for example, in twenty nineteen, Upguard researchers
Speaker 1: found a database of five hundred and forty million Facebook
Speaker 1: user data records on quote public Amazon S three cloud
Speaker 1: servers end quote. Now, arguably you could say this really
Speaker 1: wasn't Facebook's fault, This was the fault of a third
Speaker 1: party company that was working with Facebook. That third party
Speaker 1: company was Cultura Collectiva, which was a media and app
Speaker 1: developer company. So you could say that, you know, Cultura
Speaker 1: Collectiva was a customer for Facebook, and they had this
Speaker 1: massive database of Facebook user data, presumably so that they
Speaker 1: could develop the apps or whatever that they were working on,
Speaker 1: and they were storing this database on an Amazon S
Speaker 1: three cloud server, but they failed to actually secure that
Speaker 1: information on the cloud. They didn't put protections in place
Speaker 1: to prevent unauthorized people from being able to access, which
Speaker 1: is a big old whoopsie. But I think it's fair
Speaker 1: to say that it was not Meta's direct fault for
Speaker 1: this one. It sounded to me like this was the
Speaker 1: third party that arranged to have the database on that server.
Speaker 1: But I don't know if Facebook had done that, Like
Speaker 1: if Meta had made it available on that server and
Speaker 1: then gave access to Cultura Collectiva but failed to secure
Speaker 1: that access appropriately, then yes, it would have been Meta's fault.
Speaker 1: I honestly don't know the details where I can make
Speaker 1: a determination in that regard. Anyway, That's really just the
Speaker 1: tip of the iceberg when it comes to data breaches
Speaker 1: with Meta slash Facebook. And given the reach of platforms
Speaker 1: like Facebook and Watsapp and Instagram, you know, all these
Speaker 1: different meta properties, it really should come as no surprise
Speaker 1: that any data breach that targets Meta is going to
Speaker 1: end up being one of the largest in US history
Speaker 1: simply because they have such a huge user base, right like,
Speaker 1: just by definition, if it's an effective attack, it's going
Speaker 1: to be one of the largest ever. So again, it's
Speaker 1: one of those things that you know, it makes Meta
Speaker 1: such an attractive target for attackers, the fact that it's
Speaker 1: this huge. Okay, we've got lots more to go through,
Speaker 1: and rather than start the next entry and then just
Speaker 1: have to take a break in the middle, let's take
Speaker 1: a break. Now, we'll be back with numbers four and three.
Speaker 1: I think, okay, we're back. So number four on our
Speaker 1: list of largest data breaches in US history is another
Speaker 1: financial institution. So in the last episode, I mentioned how
Speaker 1: a twenty fourteen hack on JP Morgan Chase demonstrated that
Speaker 1: it wasn't just web based companies that were at risk.
Speaker 1: In May twenty nineteen, that lesson was reinforced when poor
Speaker 1: data security practices meant the first American financial corporation inadvertently
Speaker 1: made it possible for anyone with a particular weblink and
Speaker 1: able to access some really sensitive financial information. There was
Speaker 1: no hacking required. Literally, all you needed was the URL
Speaker 1: and boom you could view a whole bunch of files,
Speaker 1: and by whole bunch, I mean nine hundred million files almost,
Speaker 1: so you know, more than eight hundred billion. I think
Speaker 1: it was like eight hundred and eighty million something along
Speaker 1: those lines. So what the heck happened? Well, whomever first
Speaker 1: American financial corporation hired to do web design made a
Speaker 1: major boo boo, And I'd like to think it was
Speaker 1: an honest but dumb mistake and not you know, some
Speaker 1: sort of malicious or premeditated attempt to gain access to
Speaker 1: sensitive information. So essentially, the web developer failed to include
Speaker 1: any sort of authorization or verification process to access this
Speaker 1: list of files. So maybe the thought was just that,
Speaker 1: you know, the URL for the web directory wouldn't be
Speaker 1: published anywhere, so the only people who would even have
Speaker 1: access to it were the ones who knew what the
Speaker 1: UURL was. And if that was the thought, like if
Speaker 1: it was like, oh, we don't need to institute anything
Speaker 1: else because this is a private web address, who's going
Speaker 1: to see it? That would be a practice that's called
Speaker 1: security through obscurity, which by the way, is not very
Speaker 1: secure at all. And as the name implies, the hope
Speaker 1: is that by flying below the radar of attackers, no
Speaker 1: one takes notice of you, so you remain safe, not
Speaker 1: because you're practicing really good security, but because no one
Speaker 1: has spotted you, and so no one has decided to
Speaker 1: target you. Sometimes this isn't something that you're actively practicing,
Speaker 1: it's just kind of in effect. I have argued in
Speaker 1: the past that Apple enjoyed security through obscurity. For many years,
Speaker 1: you didn't see much malware targeting Apple systems. Apple fans
Speaker 1: would argue this was because Apple was just better at
Speaker 1: security than companies like Microsoft or IBM. In fact, some
Speaker 1: of Apple's own ads seemed to me at least to
Speaker 1: imply that one advantage Apple computers had over Windows based
Speaker 1: PCs is that they were more secure. Now, I would
Speaker 1: counter that I don't think Apple was necessarily so much
Speaker 1: better at security. I mean, granted, they were using proprietary systems,
Speaker 1: including proprietary software and hardware, which does make it harder
Speaker 1: to develop malware for those platforms. It doesn't make it impossible,
Speaker 1: but it makes it harder. But I think that the
Speaker 1: vast majority of people, I don't think this this is true.
Speaker 1: The vast majority of people were not using Apple computers.
Speaker 1: They were on Windows based machines. So, yeah, there were
Speaker 1: people using Apple computers, but if you looked at the percentages,
Speaker 1: I mean, Apple was just dwarfed by Windows machines. So
Speaker 1: if you are a hacker and you're going to dedicate
Speaker 1: the time and effort into developing malware, and you have
Speaker 1: a specific goal in mind, whatever that goal might be,
Speaker 1: you're more likely going to aim at the largest target
Speaker 1: in order to have the biggest impact. Like, that's going
Speaker 1: to make more of a difference than affecting a relatively
Speaker 1: small population of Apple users. Go for the bigger population
Speaker 1: of Windows users. That's security through obscurity, right, Like, yes,
Speaker 1: the security might have been better to some degree, but
Speaker 1: that's not why Apple was so safe for the longest time.
Speaker 1: It was also safe or what was not the only reason?
Speaker 1: I guess I should say it was also safe because
Speaker 1: the company's market share was small enough that a lot
Speaker 1: of hackers just didn't see the return on investment to
Speaker 1: develop malware for Apple when most people were using Windows
Speaker 1: machines anyway, Whether the thought was that no one who
Speaker 1: was unauthorized would even find their way to this URL,
Speaker 1: or it was just an oversight and the web developer
Speaker 1: failed to take steps that they should have taken the
Speaker 1: vulnerability was in place, and this type of vulnerability is
Speaker 1: called an insecure direct object reference. So this is just
Speaker 1: a category for vulnerabilities, and essentially it just means that
Speaker 1: if a user has the ability to submit a specific
Speaker 1: input into a system and they can gain access to
Speaker 1: that system without having to pass through any control measures,
Speaker 1: that is an insecure direct object reference. So in this case,
Speaker 1: the input was just a web address, so the only
Speaker 1: tool that you needed was a browser. You did not
Speaker 1: have to be a hacker. You needed a web browser
Speaker 1: and you needed to put a URL into the address
Speaker 1: bar and boom, you would be taken to one of
Speaker 1: these documents. Now, adding to this problem was the fact
Speaker 1: that First American Financial Corporation was using a sequential numbering
Speaker 1: system for their documents, which meant if you had discovered
Speaker 1: a URL that brought you to one of these documents,
Speaker 1: you could then adjust the numeral that was at the
Speaker 1: end of the file name, and if you went down one,
Speaker 1: then you'd see the previous record, and if you went
Speaker 1: up one, you'd see the next record. So what kind
Speaker 1: of records are we talking about. Well, it included stuff
Speaker 1: like bank statements, receipts, actual bank account numbers, drivers licenses,
Speaker 1: and other stuff. Now, on the bright side, while security
Speaker 1: researcher Brian Krebs reported on the discovery of the issue,
Speaker 1: it appeared that no unauthorized third parties with malicious intent
Speaker 1: had actually accessed this information. You could argue, really just
Speaker 1: a matter of luck. Also, there was no way to
Speaker 1: really know. But it just didn't seem like this stuff
Speaker 1: was showing up anywhere where you would say, oh, the
Speaker 1: bad guys got hold of this, right. It wasn't like
Speaker 1: it was popping up on the dark web. Perhaps because
Speaker 1: it seemed that no criminals had found out about this
Speaker 1: problem before First American could actually, you know, address it,
Speaker 1: the SEC went fairly light on the financial institution, at
Speaker 1: least in my opinion. First American was ordered to pay
Speaker 1: a five hundred thousand dollars fine. Now, five hundred thousand
Speaker 1: dollars is a lot of money. If you hit me
Speaker 1: with a five hundred thousand dollars fine, I would be
Speaker 1: up the creek. I would be so deep in trouble.
Speaker 1: But when you think of like a financial institution and
Speaker 1: the fact that this this data leak scope was nearly
Speaker 1: a billion records of incredibly sensitive financial information. I think
Speaker 1: it's still a fairly light fine to have to pay.
Speaker 1: The State of New York would actually secure a million
Speaker 1: dollar payout from First American in a lawsuit settlement, so
Speaker 1: that was twice as much. Now it may be, and
Speaker 1: I haven't looked at this. It maybe that the SEC
Speaker 1: just had limitations on how much it could find an institution,
Speaker 1: in which case, you know, no fault on them. It's
Speaker 1: not like it's not like they could do more. If
Speaker 1: you throw the book at someone, you don't typically assume
Speaker 1: the person has a second book to throw. More recently,
Speaker 1: First American was in the news again in late twenty
Speaker 1: twenty three when hackers claiming to be part of the
Speaker 1: infamous Alpha and black Cat groups infiltrated company systems and
Speaker 1: encrypted several directories as a ransomware attack. Now, this disrupted
Speaker 1: First Americans operations for a short while, but the company
Speaker 1: assured the public that the attackers had failed to lock
Speaker 1: off anything that was absolutely critical for operations, and at
Speaker 1: first they believe that customer records weren't act. However, very
Speaker 1: recently First American revealed that quote personal information pertaining to
Speaker 1: approximately forty four thousand individuals may have been accessed without
Speaker 1: authorization as a result of the incident. End quote. This
Speaker 1: is according to the title report dot com. So the
Speaker 1: company is going to be contacting those who are potentially
Speaker 1: affected and offer identity protection services and credit monitoring for
Speaker 1: free for you know, some amount of time. I don't
Speaker 1: know for how long. Number three on our list is
Speaker 1: a real estate education company. It is called the Real
Speaker 1: Estate Wealth Network. Now, before I did any research on
Speaker 1: this episode, I had not heard about this particular data breach.
Speaker 1: This one I just missed. When it happened, it was
Speaker 1: big news, and somehow I didn't see it, And it
Speaker 1: really was a data leak. So similar to what we
Speaker 1: just talked about with First American. As opposed to you know,
Speaker 1: hackers compromising a system, this is more of a company
Speaker 1: failing to put in the proper measures to protect information.
Speaker 1: Before I read about this particular situation, my imagination went wild, right,
Speaker 1: because it's the Real Estate Wealth Network. I in my
Speaker 1: imagination thought, aha, this is going to be a story
Speaker 1: about some sort of crypto anarchist, right, because here's a
Speaker 1: company that's dedicated to teaching folks how to build wealth
Speaker 1: by buying up real estate in many parts of the
Speaker 1: United States. Right now, we're in sort of a housing crisis.
Speaker 1: There are a lot of middle class Americans who cannot
Speaker 1: afford to buy a house, which is a change from
Speaker 1: previous generations. Right like, you have people who are in
Speaker 1: the same relative space in middle class, who, unlike earlier generations,
Speaker 1: cannot buy an average home or a suitable home. So
Speaker 1: the housing prices have skyrocketed in various regions throughout the
Speaker 1: United States in recent years, and a lot of properties
Speaker 1: seem to get scooped up by people or companies determined
Speaker 1: to turn the houses into lucrative vacation rental properties a
Speaker 1: la Airbnb and such. So I am imagine this data
Speaker 1: breach was the work of some crypto anarchist akin to
Speaker 1: the main character in v for Vendetta. You know, a
Speaker 1: person who was determined to take down the system by
Speaker 1: targeting a wealth generation platform that by its very existence
Speaker 1: seemed to put the common person at a disadvantage. But no,
Speaker 1: it's nothing quite so dramatic as that. This is another
Speaker 1: case of a company failing to institute basic security measures
Speaker 1: in place in order to protect sensitive information. So let's
Speaker 1: talk about that information first, and then I will talk
Speaker 1: about what actually happened. So the leaked info included all
Speaker 1: the top hits, you know, your basic stuff like customer names,
Speaker 1: their phone numbers, addresses, that kind of thing. But it
Speaker 1: also included other stuff like tax IDs, or whether or
Speaker 1: not the entity that owned the property had ever gone
Speaker 1: through bankruptcy, or if there were any court judgments against
Speaker 1: the property owner. Obviously, it also included property history records
Speaker 1: like when it was bought and sold and who bought
Speaker 1: it or sold it. And there were a lot of
Speaker 1: these data records, or like a one and a half
Speaker 1: billion data records in total. Some of them included information
Speaker 1: about very notable people, you know, like politicians and celebrities
Speaker 1: and that kind of thing. And you could imagine this
Speaker 1: sort of crime meant that the people who had access
Speaker 1: to this information could do all sorts of other crimes,
Speaker 1: everything from spearfishing, which would be a breeze because you
Speaker 1: would have so much information about your target, you could
Speaker 1: craft a very convincing attack that would potentially compromise them further.
Speaker 1: You would have all the information you needed to commit
Speaker 1: some pretty nasty fraud crimes in the name of some
Speaker 1: of these victims. Not to mention now that you have
Speaker 1: these notable people like politicians and celebrities. You have information
Speaker 1: that you know, stalkers would really like, or people who
Speaker 1: have a particular desire to hurt somebody specific they might
Speaker 1: really want the information. So yeah, there's a whole host
Speaker 1: of crimes that can happen as a result of this.
Speaker 1: So what actually happened? How did this come about? Well,
Speaker 1: the simple explanation is that the Real Estate Wealth Network
Speaker 1: failed to put any security around accessing this database, which
Speaker 1: held one point one six terabytes of information in it.
Speaker 1: There was this security researcher named Jeremiah Fowler who discovered
Speaker 1: the problem. He found an unencrypted, massive database containing extremely
Speaker 1: sensitive information, and he said he found it after searching
Speaker 1: for his own details, and then he followed a trail
Speaker 1: that led to this database. So I don't know if
Speaker 1: he was just like doing this search just on his
Speaker 1: own and that had nothing to do with, you know,
Speaker 1: any kind of investigation and just stumbled upon this, or
Speaker 1: if he had already heard something about this or suspected
Speaker 1: something about it and then started to do some searching
Speaker 1: and came across it. Either way, he reported the problem
Speaker 1: to the Real Estate Wealth Network, and to their credit,
Speaker 1: they promptly locked down access to the database, They closed
Speaker 1: off that avenue toward the data, and they also confirmed
Speaker 1: that they owned the data base, which again all credit
Speaker 1: to Real Estate Wealth Network for doing this. They acknowledged
Speaker 1: the data leak, and honestly, that had a real breath
Speaker 1: of fresh air to it, because, yes, the leak never
Speaker 1: should have happened in the first place, but at least
Speaker 1: we're not talking about an incident in which the company
Speaker 1: delayed installed for days, weeks, months, or even years before
Speaker 1: finally owning up to it. Because spoiler alert number one
Speaker 1: on this list did that. It's a company that held
Speaker 1: back on disclosing information about a massive data breach for
Speaker 1: multiple years. But no, Real Estate Wealth Networks was pretty
Speaker 1: quick to disclose this issue, which is really the responsible
Speaker 1: thing to do, right, to warn those who have been
Speaker 1: affected so that they could be on the lookout for
Speaker 1: any signs that malicious actors have accessed that information. However,
Speaker 1: despite this responsible approach, you know, you still have to
Speaker 1: admit there were some pretty massive problems here. So for
Speaker 1: one thing, it was not clear how long that database
Speaker 1: had been unsecured, right it could have been unsecured for ages.
Speaker 1: It was also unknown whether anyone besides you know, the
Speaker 1: security research or Fowler had noticed this issue, because you know,
Speaker 1: if criminals had found it, they would have a treasure
Speaker 1: trove of data at their fingertips, and they wouldn't likely
Speaker 1: just blurred out that they had found it if they
Speaker 1: wanted to keep accessing it, although they could have made copies.
Speaker 1: And apparently, from what I understand, no one found anything
Speaker 1: about this on the dark web, So that's a fairly
Speaker 1: good indicator that it was unnoticed by the criminal element.
Speaker 1: But I mean, it would have only been a matter
Speaker 1: of time. So the fact that Fowler found it and
Speaker 1: that Real Estate Wealth Networks responded so quickly, that's really
Speaker 1: a good thing. But yeah, this data included you know,
Speaker 1: information about actual like celebrities, everyone from Britney Spears to
Speaker 1: Elon Musk to Nancy Pelosi. So okay, we're coming down
Speaker 1: to our top two entries on this list. Although I
Speaker 1: should remind everybody that while I'm presenting this as a
Speaker 1: top ten countdown, in episode one was like ten through
Speaker 1: five and a half and this is five through one,
Speaker 1: I should mention Kyle Chen did not claim that his
Speaker 1: list was ordered in any kind of ranked way. He
Speaker 1: listed twenty six different data breaches, and I don't wish
Speaker 1: to imply that this is Kyle Chin's ranking. I just
Speaker 1: chose to interpret it that way. So I'm just an
Speaker 1: Internet hack. Really. Maybe at some point I'll do an
Speaker 1: episode covering the other sixteen data breaches. But we're gonna
Speaker 1: take a quick break right now for some more messages,
Speaker 1: and when we come back, we're gonna keep on hacking. Okay,
Speaker 1: we're back, and I mentioned before the break, we're gonna
Speaker 1: keep on hacking. And hacking actually does play a part
Speaker 1: in numbers two and one, right, because the last two
Speaker 1: those weren't really data breaches. Those were data leaks. A breach,
Speaker 1: I would argue, is when an outsider, a hacker, has
Speaker 1: managed to infiltrate a system in some way. They have
Speaker 1: breached the security whatever there might be of a system.
Speaker 1: Data leaks are when you don't have any security in
Speaker 1: place and no one actively has to be like searching
Speaker 1: for it. It's just out there and it's available if
Speaker 1: you happen to nowhere to look. Well, this is definitely
Speaker 1: a breach, not a leak, and it's one that puts
Speaker 1: Microsoft in the spotlight. The Culprit was an allegedly China
Speaker 1: backed hacker group called Hafnium. The target were Microsoft Exchange servers.
Speaker 1: So to be clear, the targets weren't just Microsoft. It
Speaker 1: wasn't like the they were going after the company Microsoft.
Speaker 1: They were going after companies that were using Microsoft Exchange servers,
Speaker 1: So customers of Microsoft. That's who these hackers were going after.
Speaker 1: And the entry point was allegedly four separate zero day vulnerabilities.
Speaker 1: Now I mentioned in the previous episode. A zero day
Speaker 1: vulnerability is one that the person or entity that's responsible
Speaker 1: for the softwareware, or system doesn't know about. That's what
Speaker 1: makes it a zero day vulnerability. They have zero days
Speaker 1: to address any sort of exploit that pops up in
Speaker 1: the wild, and zero day vulnerabilities are like gold to hackers.
Speaker 1: They represent an opportunity to infiltrate systems without fear of
Speaker 1: being stopped or sometimes even detected, and that gives hackers
Speaker 1: way more time and opportunities to achieve whatever goals they have,
Speaker 1: whether that's stealing information or breaking entire directories as part
Speaker 1: of a ransomware attack, or infiltrating systems with malware, whatever
Speaker 1: it might be. One zero day vulnerability is bad for
Speaker 1: zero day vulnerabilities is really really bad. And on top
Speaker 1: of that, some of these vulnerabilities had sort of been
Speaker 1: grandfathered in from software that had been out for almost
Speaker 1: a decade at that point. One key element that made
Speaker 1: this particular attack so devastating was that many of the
Speaker 1: customers using Microsoft Exchange kept their own email servers on
Speaker 1: company premises or on prem as those in the biz
Speaker 1: call it, so in case you're not familiar with that term,
Speaker 1: it just means that a company hasn't offloaded everything to
Speaker 1: the cloud. At least some of their servers that they're
Speaker 1: using are on company property, whether that's in the company
Speaker 1: HQ or a data center or whatever. The point is,
Speaker 1: they own and operate the server. They're just running the
Speaker 1: Microsoft Exchange product on those servers. So these are computers
Speaker 1: that are not under the direct supervision of Microsoft. And
Speaker 1: that's the important part, and the reason it's important is
Speaker 1: that once Microsoft became aware of these vulnerabilities, they could
Speaker 1: and they did release security patches to plug up those holes,
Speaker 1: which would stop attackers from being able to infiltrate those
Speaker 1: Microsoft Exchange servers. But while Microsoft could install these patches
Speaker 1: directly onto any systems that were under their direct control.
Speaker 1: They couldn't do that with exchange servers that were on
Speaker 1: premises on customer property, right because Microsoft doesn't have that access.
Speaker 1: You wouldn't want Microsoft to have that access. You know,
Speaker 1: the whole reason to have on premises systems is that
Speaker 1: those are under your direction and control. So you don't
Speaker 1: want to give another party access to that's that's a
Speaker 1: security vulnerability. So that meant Microsoft had to send out
Speaker 1: messages to their customers that essentially said, hey, you need
Speaker 1: to install these security patches asap, like yesterday, and the
Speaker 1: customers were in charge of actually following through on that
Speaker 1: because they were maintaining their own on premises email servers.
Speaker 1: And you know, some companies have it departments that will
Speaker 1: respond immediately to these kinds of messages and install those
Speaker 1: kind of security patches, but there are cases where that
Speaker 1: doesn't happen. Now, sometimes the decision not to implement a
Speaker 1: security patch right away is actually done out of a
Speaker 1: sense of caution, because occasionally you'll get a patch that
Speaker 1: once you install, but it has unintended consequences on your operations,
Speaker 1: right it might break something else, And so sometimes companies
Speaker 1: won't install a security patch on the initial day of
Speaker 1: release just in case that patch causes other issues. They
Speaker 1: take a wait and see approach to make sure that
Speaker 1: they're not going to interrupt their regular business operations by
Speaker 1: installing this patch. But that means that they remain vulnerable
Speaker 1: for as long as the patch remains uninstalled. Now, other times,
Speaker 1: you might have IT departments that just are not on
Speaker 1: top of the ball, and that means some companies would
Speaker 1: just go unprotected longer than others. Sometimes you don't really
Speaker 1: have an IT department at all, Right, You've outsourced a
Speaker 1: lot of stuff, and so you don't necessarily have the
Speaker 1: assets in place to be able to install security patches.
Speaker 1: You're depending too heavily upon third parties and as a result,
Speaker 1: you may not have the staff who has the knowledge
Speaker 1: of how to install those security patches. It's possible there
Speaker 1: are still some servers out there that aren't protected, though
Speaker 1: I hope that's not the case because it has been
Speaker 1: like three years since this attack happened, and surely someone
Speaker 1: has installed security updates within those three years. But you
Speaker 1: never know anyway, what did the attackers actually achieve, what
Speaker 1: was their goal and what did they do well by
Speaker 1: exploiting these vulnerabilities in Microsoft's software. The hackers gained access
Speaker 1: to these infected email servers, and that meant they could
Speaker 1: access all the email on that server as if they
Speaker 1: were the administrator of the server. They could read everything,
Speaker 1: so they could go into any account on that email
Speaker 1: server and read stuff. They could send email as someone
Speaker 1: else if they wanted to, and they could harvest data
Speaker 1: in contacts. They could pull all the information off of
Speaker 1: calendars like they could gather a lot of valuable information. Now,
Speaker 1: in this case, the targets were companies, not necessarily individuals. However,
Speaker 1: if they were able to compromise a company system that
Speaker 1: had an individual of interest on it, then they could
Speaker 1: pull tons of information about that person as part of
Speaker 1: their attack. The attackers were able to compromise the email
Speaker 1: servers of around thirty thousand companies in the United States.
Speaker 1: Thirty thousand companies, not people like keep in mind, like
Speaker 1: these businesses might employ hundreds or thousands of people. They
Speaker 1: were also able to compromise another thirty thousand businesses around
Speaker 1: the world, so sixty thousand total. Brian Krebs, once again
Speaker 1: was the researcher who wrote about these attacks and alerted
Speaker 1: the world in general as to what was going on.
Speaker 1: The revelation came just a few days after Microsoft had
Speaker 1: released emergency security updates. By the way, there are actually
Speaker 1: a lot of security researchers out there, the white hat
Speaker 1: hacker types, who tend to have a general code of
Speaker 1: honor right. If they discover a vulnerability in a system,
Speaker 1: typically what they do is they reach out to the
Speaker 1: company or person responsible for that system and they alert them.
Speaker 1: They say, hey, I found this, it's possible to exploit.
Speaker 1: You're gonna want to patch it. And typically they'll give
Speaker 1: a little bit of time for the company to respond
Speaker 1: to this, and then they'll wait for that response before
Speaker 1: they reveal what they know to the public. That's the
Speaker 1: responsible way to do it, so that the least amount
Speaker 1: of damage is done. However, if a company fails to respond,
Speaker 1: like if it doesn't acknowledge the fact that you have
Speaker 1: alerted them to this vulnerability at all, well, sometimes researchers
Speaker 1: will reveal what they know in an effort to pressure
Speaker 1: the company into responding. If they go public and say
Speaker 1: this vulnerability exists, then there's suddenly this enormous amount of
Speaker 1: pressure on the company to fix it, and then also
Speaker 1: warns the customers of that company that the product they're
Speaker 1: using isn't secure. However, in this case, Microsoft acted very
Speaker 1: quickly and then Brian Krebs reported on it, so back
Speaker 1: to Microsoft. US cybersecurity experts determine that the hacker group
Speaker 1: Halfnium was responsible for these attacks, and that in turn
Speaker 1: Halfnium enjoyed the backing and protection of the Chinese government. Further,
Speaker 1: the attacks were assumed to be part of a large
Speaker 1: espionage mission to spy upon and steal information from US companies.
Speaker 1: In particular, The Guardian reported that the US government, in
Speaker 1: the form of the FBI, the Federal Bureau of Investigation,
Speaker 1: took a rather extreme step to protect companies by hacking
Speaker 1: into infected systems that belonged to various companies that had
Speaker 1: failed to mitigate the malware themselves. In order to actually
Speaker 1: neutralize the threat, so the FBI hacked into company systems
Speaker 1: in order to shut down the malware. The FBI did
Speaker 1: not go the extra step to install the security updates
Speaker 1: on those systems. But apparently the FBI was fighting hacking
Speaker 1: by hacking, I guess, and not directly against the hackers,
Speaker 1: but against the same companies that had already been hacked.
Speaker 1: When it comes to zero day vulnerabilities. I don't think
Speaker 1: there's really anything I can say that's terribly helpful. I mean,
Speaker 1: how do you fix a problem if you don't know
Speaker 1: there is a problem. So, you know, it might be
Speaker 1: tempting to blame Microsoft for leasing software platforms that had
Speaker 1: these vulnerabilities in them, but again, if the company has
Speaker 1: no awareness that there's an issue, how are they supposed
Speaker 1: to fix it? So I think just saying do better
Speaker 1: isn't really useful. You see that a lot in the
Speaker 1: gamer community. It's very dismissive and snobby, and I hate
Speaker 1: it and it's not useful at all. It's not helpful.
Speaker 1: So I don't really think that's a viable response. As
Speaker 1: for customers, well, there's even less that you can do
Speaker 1: as a customer to prevent an attack that leverages a
Speaker 1: zero day vulnerability in some tool that your company is using.
Speaker 1: The best you can do is beyond the ball when
Speaker 1: security patches come out to minimize the risk of becoming
Speaker 1: another victim, or to at least temporarily migrate away from
Speaker 1: a tool that's been known to have been compromised. Okay,
Speaker 1: we're finally up to number one on the list, and maybe,
Speaker 1: like I said, I'll do a future episodes to cover
Speaker 1: some of the other instances that Kyle Chen mentions. So again,
Speaker 1: if you didn't hear me before, these are all coming
Speaker 1: from a blog post that Kyle Chen wrote for upguard
Speaker 1: dot com, So you can always look up like the
Speaker 1: largest data breaches in US history. That'll probably pull that
Speaker 1: article up as a result. That's where I'm getting this
Speaker 1: particular list. But our number one entry is Yahoo, and yeah,
Speaker 1: this one was huge. Also, I can't really say this
Speaker 1: one because the word one is deceptive. Honestly, this was
Speaker 1: a series of cyber attacks that ultimately resulted in more
Speaker 1: than three billion records being exposed to cyber criminals. Three billion.
Speaker 1: That's nearly forty percent of the world's population. Though honestly,
Speaker 1: that's three billion accounts. I'm sure that some people had
Speaker 1: multiple accounts, so it's not the same thing as three
Speaker 1: billion people, I guess, But that seems like a fine
Speaker 1: point that we don't really need to worry about. If
Speaker 1: we do assume that's three billion people, that means if
Speaker 1: you were to get ten people together, four of those folks,
Speaker 1: or really three point seven eight of them would be
Speaker 1: affected by this. But those chances would actually depend upon
Speaker 1: where in the world you are, right, Like, if you're
Speaker 1: in a more developed part of the world, then the
Speaker 1: odds are going to be higher that there'll be more
Speaker 1: people there who were affected by this. My analogy only
Speaker 1: works if the ten people are randomly selected from all
Speaker 1: over the world. But anyway, I'm on a tangent. So
Speaker 1: what happened, Well, what happened was a combination of various
Speaker 1: hacking techniques, some international intrigue, a company staying quiet about
Speaker 1: the whole thing for way too long after finding out
Speaker 1: about this intrusion, possibly in an effort to avoid affecting
Speaker 1: a massive acquisition deal that was going on with another
Speaker 1: big company. Because this story is juicy, y'all. But we
Speaker 1: begin in twenty thirteen, and this is when the first
Speaker 1: and the largest hack happened, though the public would not
Speaker 1: find out about it for another three years. Now. Arguably,
Speaker 1: Yahoo itself remained ignorant of this attack for quite some time,
Speaker 1: but it would take three years for the US public
Speaker 1: to hear that this had happened. Even in that revelation,
Speaker 1: Yahoo would downplay how many accounts were affected by a
Speaker 1: third in fact, because, as we would later hear in
Speaker 1: twenty seventeen, the attack compromised some three billion accounts, but
Speaker 1: when Yahoo disclosed this attack to the public back in
Speaker 1: twenty sixteen, Yahoo said it was just one billion, which
Speaker 1: is weird. I was saying, just is crazy. I mean,
Speaker 1: one billion is a number so huge that I cannot
Speaker 1: possibly imagine it. So you might as well cop to
Speaker 1: all three billion at that point, right, But to be
Speaker 1: fair to Yahoo, I do think it's very possible the
Speaker 1: company honestly did not have a grasp on how large
Speaker 1: this attack actually was at that time. And by large
Speaker 1: I do mean every single Yahoo account active or otherwise
Speaker 1: was affected by this because the company had lousy security.
Speaker 1: There's no getting around it. I don't think that's opinion,
Speaker 1: by the way, because in twenty twelve, Yahoo had already
Speaker 1: been the target of a different hacker attack that ultimately
Speaker 1: compromised nearly half a million accounts. Now half a million
Speaker 1: is a drop in the bucket compared to three billion.
Speaker 1: It's nothing. But you would think that half a million
Speaker 1: compromised accounts would be a serious wake up call to Yahoo,
Speaker 1: and it would at least kick things into gears so
Speaker 1: that the company would institute better security practices. But sadly,
Speaker 1: that didn't really happen, or at least it didn't happen
Speaker 1: on a scale and timeline that would prevent the massive
Speaker 1: intrusion in twenty thirteen. Now, it is easy to conflate
Speaker 1: the twenty thirteen attack with another one that happened in
Speaker 1: twenty fourteen. So if you're keeping count, that's three different
Speaker 1: hacker intrusions in three years. Twenty twelve was half a million,
Speaker 1: twenty thirteen three billion, twenty fourteen was like five hundred million.
Speaker 1: I think it is important to draw some distinctions between
Speaker 1: these because authorities would ultimately identify four individuals believed to
Speaker 1: be responsible for the twenty fourteen attack. These folks would
Speaker 1: also end up having alleged ties to the Russian government. Thus,
Speaker 1: there are locations that the Yahoo hack in twenty fourteen
Speaker 1: was the result of a state backed hacking operation, that
Speaker 1: it was essentially funded by the Russians. Now, whether the
Speaker 1: twenty thirteen attack was state backed or not, we don't
Speaker 1: really know. To this day. As far as I can tell,
Speaker 1: no one has the definitive information on who was behind
Speaker 1: the twenty thirteen attack. Marissa Meyer, who was CEO of
Speaker 1: Yahoo during those data breaches, would testify to Congress in
Speaker 1: twenty seventeen that the company had been unable to determine
Speaker 1: who was responsible for that particular attack in twenty thirteen.
Speaker 1: She also revealed that she did learn of the twenty
Speaker 1: fourteen intrusion in twenty fourteen, this is the one that
Speaker 1: would affect half a billion accounts, but she didn't learn
Speaker 1: of the actual scale of the attacks until twenty sixteen.
Speaker 1: So if that's true, it meant the attackers had some
Speaker 1: really good ability to hide their tracks and had years
Speaker 1: of opportunity there as well. So presumably no one knew
Speaker 1: about the twenty thirteen attack until much later. They knew
Speaker 1: about the twenty fourteen attack, but they didn't know how
Speaker 1: bad it was. This also means I can't really talk
Speaker 1: about what happened in twenty thirteen, because the truth of
Speaker 1: the matter is there were several potential exploits that the
Speaker 1: hackers could have used, and the twenty thirteen attack may
Speaker 1: have used multiple avenues to get access to all the information.
Speaker 1: We can, however, talk about what happened in twenty fourteen.
Speaker 1: We know more about that one. It's a tail that
Speaker 1: involves spearfishing and cookies. Now I should also mention this
Speaker 1: version of the story comes to us courtesy of the FBI.
Speaker 1: The agency said that the hackers first sent spearfishing emails
Speaker 1: to Yahoo employees, So again, these are emails meant to
Speaker 1: trick someone into taking some sort of action that benefits
Speaker 1: the hacker, and in this case, it was clicking on
Speaker 1: a link that ultimately would give the hackers administrator level
Speaker 1: access to some of Yahoo's systems, but not all of
Speaker 1: their systems. But it did give them a chance to
Speaker 1: look at some code that Yahoo used that would be
Speaker 1: really valuable, and this included code on how Yahoo generated
Speaker 1: Internet cookies, So a quick refresher course on what cookies
Speaker 1: are and what they do. With the Web, You've got
Speaker 1: clients and you've got servers. So if you're browsing the
Speaker 1: web on your computer or your smartphone, you're using a client.
Speaker 1: Servers are sending or serving you the information that you're requesting.
Speaker 1: So if you type in an address in your web
Speaker 1: browser like www dot Google dot com, your client sends
Speaker 1: a request to go to that website. This request gets
Speaker 1: routed to the appropriate web server, which then sends the
Speaker 1: data to your client, so that you are visiting Google.
Speaker 1: So each interaction is kind of like this. Now, to
Speaker 1: save some time and effort, we have cookies. So cookies
Speaker 1: are little bits of info that get saved to your
Speaker 1: computer the client, and cookies can do really handy stuff.
Speaker 1: For example, let's say that you've logged into an account
Speaker 1: on a service like Amazon and you're doing some shopping,
Speaker 1: and then you navigate a way because you have to
Speaker 1: go do something else. But then gush, darn it, you remember, oh, well,
Speaker 1: you know what, I should have ordered something else on
Speaker 1: top of everything else. So you go back to Amazon. Well,
Speaker 1: if you didn't have cookies, you would need to go
Speaker 1: all the way back through the login process because Amazon
Speaker 1: wouldn't know it was you again. But with a cookie
Speaker 1: stored on your computer, Amazon can say, oh, yeah, that's
Speaker 1: Billy Bob who logged in earlier, never logged out their
Speaker 1: back Let's just let them continue their session. So cookies
Speaker 1: are how web pages quote unquote know where you were
Speaker 1: the last time you visited, so that you can kind
Speaker 1: of pick up where you left off. Of course, cookies
Speaker 1: can do more than that, and there's a whole discussion
Speaker 1: to be had about tracking and whatnot with cookies, but
Speaker 1: we're going to leave that for now. So how did
Speaker 1: the attack happen. Well, the hypothesis goes that the hackers
Speaker 1: were able to figure out how to forge Yahoo cookies
Speaker 1: because Yahoo was not good at practicing decent security, because
Speaker 1: ideally each cookie would contain data that's unique to a
Speaker 1: single individual and that would be very hard to crack.
Speaker 1: But Yahoo apparently wasn't really doing this in that regard.
Speaker 1: You could say Yahoo was kind of behaving sort of
Speaker 1: like how certain German officers in World War Two were
Speaker 1: reusing code phrases while encrypting messages using an Enigma machine. Now,
Speaker 1: the practice of reusing those code phrases, that's what gave
Speaker 1: British code breakers the advantage that they needed to actually
Speaker 1: break the code. If the Germans had used more discipline
Speaker 1: security measures, the code likely would have stood up to
Speaker 1: the BRIT's best efforts and it wouldn't have ever been broken. Possibly.
Speaker 1: I mean, it's impossible to say, because we know what
Speaker 1: did happen, it's impossible to say that what could have
Speaker 1: happened was a definite possibility. Anyway, all this meant that
Speaker 1: the hackers could actually forge a cookie, and they could
Speaker 1: fool Yahoo into thinking that the hackers were actually somebody else,
Speaker 1: like a legitimate Yahoo user, So it meant that they
Speaker 1: could access user accounts and then spy on that user's correspondence,
Speaker 1: plus scrape any data relating to that user and their
Speaker 1: other online accounts. So potentially they could even compromise even
Speaker 1: more data in the process. A right, like if you
Speaker 1: figure out a user's username and password, and you also
Speaker 1: see that they use other services, you can try and
Speaker 1: use that and see if it works. Because so many
Speaker 1: people reuse their passwords. I said it in the last episode,
Speaker 1: I'll say it again. Don't do that, And you start
Speaker 1: to see how a data breach can be much bigger
Speaker 1: than just this enormous scope of three billion accounts. So
Speaker 1: coy to Marissa Meyer, Yahoo learned about the twenty fourteen attack,
Speaker 1: even though they might not have known what the scope was,
Speaker 1: but they kept things quiet, possibly in part because there
Speaker 1: was this big acquisition deal Verizon wanted to acquire Yahoo.
Speaker 1: Some of this news, however, would break before that deal
Speaker 1: would be finalized, and Verizon would drop the offer by
Speaker 1: a whopping three hundred and fifty million dollars, So that
Speaker 1: was a big deduction on the final cost for that acquisition,
Speaker 1: and even that might have been too modest. Because, of course,
Speaker 1: later we would find out the real scope of those attacks,
Speaker 1: lawsuits would follow, but Yahoo would pay out a little
Speaker 1: more than one hundred million dollars as a result of
Speaker 1: the lawsuits, a few tens of millions here, tens of
Speaker 1: millions there in different fines, But honestly, I think it
Speaker 1: was a pretty small amount considering the nature and scope
Speaker 1: of the attack. Then again, the whole thing did cost
Speaker 1: y'all who hundreds of millions of dollars because the acquisition
Speaker 1: was reduced in price too. Only one of the four
Speaker 1: men identified as hackers in that twenty fourteen attack was
Speaker 1: ever arrested and sentenced for this crime was in a
Speaker 1: Canadian citizen named Karim Borotov. He was sentenced to five
Speaker 1: years in prison. He even wrote a book about his experiences.
Speaker 1: The other three accused, which included two members of the
Speaker 1: Russian FSB, that's kind of like the successor of the
Speaker 1: KGB in the old Soviet days. They were accused, but
Speaker 1: they were never arrested, and of course Russia denied having
Speaker 1: any involvement in the attacks whatsoever. And that brings us
Speaker 1: down to the last of my top ten. Again, I
Speaker 1: don't wish to suggest that Kyle Chin had ranked these
Speaker 1: in any specific way. This was kind of how I
Speaker 1: ranked them, and there were sixteen other ones on that list.
Speaker 1: So again, go to upguard dot com and search for
Speaker 1: that article about the largest data breaches in US history
Speaker 1: if you want to read more about them. Maybe I'll
Speaker 1: do an episode about those later. I might do an
Speaker 1: episode just about the ticketmaster data breach because that happened.
Speaker 1: That are particularly bad time for ticketmasters since it's already
Speaker 1: in the crosshairs of the US government due to an
Speaker 1: antitrust lawsuit. So maybe I'll do a full episode about
Speaker 1: that in the future too. In the meantime, I hope
Speaker 1: you're all safe. I hope all your personal information is safe,
Speaker 1: and I'll talk to you again really soon. Tech Stuff
Speaker 1: is an iHeartRadio production. For more podcasts from iHeartRadio, visit
Speaker 1: the iHeartRadio app, Apple Podcasts, or wherever you listen to
Speaker 1: your favorite shows.