12 days of CyberChristmas

Sweaters, snowflakes, stockings, and Santa are on all our minds during this holiday season. However, 'tis the season to be jolly, but not complacent!

These 12 security incidents that happened in 2021 will remind you that cybercrime yields to no one—not even Santa.

Read now
  • Security incident 1

    Social media management company Socialarks exposes the PII of LinkedIn, Facebook, and Instagram users

    Records breached: 214 million
    January 11, 2021:

    The night of January 11 may have been silent, but it definitely was not holy when a China-based social media management company, Socialarks, suffered a data breach from an inadequately protected database. This lead to the accounts and PII of nearly 214 million users of social media giants such as Facebook, Instagram and LinkedIn being exposed. This PII leak included tens of millions of email IDs, phone numbers, addresses, usernames, profile pictures, and other sensitive information.

  • Security incident 2

    Ransomware attack of the California Department of Motor Vehicles (DMV)

    Records breached: Unknown
    February 18, 2021:

    It was no joy to the world when the California DMV's Seattle-based billing contractor Automatic Funds Transfer Services (AFTS) was subjected to a ransomware attack. The data breach exposed the personal information from the last 20 months of California vehicle registration records, including names, addresses, license plate numbers, and vehicle identification numbers (VINs).

    The DMV said that it has since stopped all data transfers to AFTS and has also initiated an emergency contract to prevent any downtime. AFTS is widely used around the United States to process payments and invoices, and several other municipalities have confirmed that the data breach may not have been limited to the California DMV.

  • Security incident 3

    Zero-day attack on Microsoft Exchange Server

    Servers breached: 250,000
    March 3, 2021:

    Four zero-day exploits in the on-premises version of Microsoft Exchange Server gave hackers full access to email IDs and passwords along with administrator privilege on affected servers. They installed a backdoor, giving themselves entry to impacted servers, even after they were updated and invulnerable to the original attack. The data breach is said to have impacted over 18,000 organizations worldwide, with over 250,000 servers falling victim to the attack.

  • Security incident 4

    User account information for millions of LinkedIn users was leaked and sold for $2 on the dark web

    Records breached: 500 million
    April 6, 2021:

    It was shown that hackers will live forever more when LinkedIn was yet again attacked and over 500 million user profiles were discovered on the dark web. Hackers sold 2 million of these records for only $2 to declare the authenticity of this stolen data. The stolen information included a variety of PII such as user names, email addresses, contact numbers, job profiles, and links to other social media applications.

  • Security incident 5

    Ransomware attack on major fuel provider Colonial Pipeline

    Data breached: 100GB
    May 6, 2021:

    Colonial Pipeline, a Houston-based jet fuel and gasoline provider for the eastern US, was victim of a hacking campaign carried out by DarkSide. As a result, the company was forced to halt all pipeline operations to contain the damage. The attackers demanded a ransom of 75 Bitcoins (approximately $4 million) in exchange for nearly 100GB of stolen data. As a result, gas prices rose by six cents per gallon and there was a shortage of gas due to panic buying.

  • Security incident 6

    Massive account lockout attack on NYC's law department

    Accounts breached: 1,000
    June 7, 2021:

    New York City's law department was hacked and thousands of lawyers were locked out of their accounts. Hackers used a user's login credentials to break into the law department's network. The department immediately disconnected the affected devices from the city's network to avoid further damage. However, lawyers expressed concern since the law department holds access to sensitive data such as evidence, personal information of thousands of people, medical records, and Social Security numbers.

  • Security incident 7

    NSA reports that Russian hackers are executing brute-force attacks to access US networks

    Records breached: Unknown
    July 1, 2021:

    It was no tidings of comfort or joy when the National Security Agency (NSA) warned that the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), military unit 26165, has been performing password spray attacks on US and other foreign agencies using a Kubernetes cluster. The NSA says that the attackers perform brute-force attacks through TOR and VPN services in an attempt to hide the origin of the attack. Once they gain access, they move laterally through the network and deploy a reGeorg webshell to remain anonymous and steal data.

  • Security incident 8

    $50 million demanded as ransom from Accenture as part of ransomware attack by LockBit operators

    Data breached: 6TB
    August 11, 2021:

    IT giant Accenture could not go tell it on the mountain when LockBit, a ransomware group, used credentials stolen during the Accenture cyberattack to their advantage. The group compromised an airport that was using Accenture software and encrypted its systems. Initially, Accenture denied these claims but LockBit said that it had collected sufficient data to breach some of Accenture's clients. LockBit imposed a ransom of $50 million to stop the leak of 6TB of data.

  • Security incident 9

    Data breach on Fitbit and Apple wearables exposed 61 million fitness records

    Records breached: 61 million
    September 14, 2021:

    Researchers with WebsitePlanet and security researcher Jeremiah Fowler discovered an unprotected database that contained fitness and sleep records of 61 million Fitbit and Apple users. Cybercriminals could literally see when affected users were sleeping and know when they're awake. The unprotected database belonged to GetHealth, an online and mobile tool that provides a unified platform to access health and wellness data from hundreds of wearables, medical devices, and apps.

  • Security incident 10

    Computer giant Acer faced with $50 million ransom demand after second major cyberattack

    Data breached: 60GB
    October 13, 2021

    Taiwanese electronic giant Acer suffered a major ransomware attack by a group of hackers called Desorden. The hackers claimed to have stolen over 60GB worth of data that included sensitive information about millions of Acer's clients including phone numbers, names, corporate financial data, and other personally identifiable information. This attack came not long after Acer was a victim of another ransomware attack by REvil during which the attackers demanded a $50 million ransom.

  • Security incident 11

    Iran's second-largest airline, Mahan Air, hit by a cyberattack

    Records breached: Unknown
    November 22, 2021

    A cyberattack on Iran's second-largest airline, Mahan Air, has been reported by the Iranian state media. Though the airline's flight schedule was not affected by the attack, its official website was down. Officials said that the airline has been targetted on multiple occasions due to the country's important position in the aviation industry.

  • Security incident 12

    1.2 million WordPress accounts exposed after a cyberattack on web host GoDaddy

    Records breached: 1.2 million
    November 23 , 2021

    Domain registrar and web hosting giant GoDaddy was subjected to a cyberattack, and close to 1.2 million WordPress accounts were reported to be compromised. The Arizona-based company disclosed the breach in an SEC filing and confirmed that sensitive data including usernames, passwords, email addresses, and private SSL keys were stolen.

Want to steer clear of cyber attacks?

Deploy Log360 now and stay vigilant
this holiday season!

Just for you

Start a cyber safe new year with exclusive offers on Log360.

This offer is valid until 31st December, 2021 only. Please note that this offer is applicable only for direct new purchases from ManageEngine and is not applicable on renewals and upgrades.

Thank you

Check your inbox for an email with the e-book download link.

Fill this form our team will get back to you

  • By clicking '' you agree to processing of personal data according to the Privacy Policy.

Thank you for downloading this e-book. Please check your Inbox (or spam) to access this e-book.

Thank you for your interest. We'll get in touch with you soon