Major data breaches: Attack methods, stats and predictions
Medusind, Finastra, France Travail, AT&T, Dropbox Sign, Slim CD and MOVEit: how each breach happened, what it cost, and which controls would have stopped it.
By 7 mins readPublished Updated On this page
Seven breaches and how the attackers got in
Seven breaches from 2024 and early 2025, from France Travail's 43 million records to Medusind's 360,000, share a short list of causes: stolen credentials, a missing second factor, misconfigured access and one zero-day. The targets were healthcare, finance, telecoms, government and SaaS.
For each one: what was taken, how the attacker got in, and what it says about the next attack.
1. Medusind inc. (January 2025)
Medusind told 360,000 people that their personal information, health records, payment details and government identification had been exposed.
The attackers got in through Medusind's billing systems and took the data out. Reports describe the attack as ransomware, name a LockBit 3.0 variant, and put the demand at $5 million with a settlement at $2.5 million after several rounds of negotiation.
Healthcare stays a top target because medical records sell. One estimate puts a record at up to $1,000 on the dark web, and each one supports identity theft, insurance fraud and payment fraud.
Figure 1: Ransomware attack lifecycle, from initial access through exfiltration, encryption and the ransom demand to victim notification.
2. Finastra (November 2024)
Over 400GB of private customer data left Finastra, exposing bank accounts, passwords and money transfer records.
The way in was stolen employee passwords. From there the attackers moved through the network, raised their access level and copied files for weeks before they were caught. The reporting cites weak spots in Microsoft Windows systems and the use of Mimikatz to harvest more credentials, and one estimate put the possible financial harm at $100 million.
Financial firms are hit for the obvious reason. This breach is the case for two controls: stronger login checks and alerts that fire while the attacker is still inside. Password-related breaches rose 86% in 2024.
Figure 2: From credential theft through lateral movement and data extraction to financial fraud and legal consequences.
3. France Travail (March 2024)
France's employment agency lost personal data on 43 million people: social security numbers, employment history and contact details.
The attackers got past weak authentication to reach the database and pulled the records out. The reporting points to outdated SSL/TLS configurations and weak password policies; multi-factor authentication and regular security audits are the standard fixes. Data on that scale is raw material for fake identities and for getting into other government systems.
Government agencies hold more citizen data than almost anyone, which draws nation-state actors and criminals who want to sell it in equal measure.
Figure 3: Weak authentication bypassed, database reached, personal data extracted, then victims and authorities notified.
4. AT&T (July 2024)
Nearly every AT&T phone customer was affected. The stolen records showed who each customer had called and texted.
The reporting describes phishing emails, made to look like internal messages, that captured employee passwords. Those passwords opened the cloud platform (Snowflake) where the records lived, and that account had no second factor such as a text message code. AT&T has since offered free identity theft protection and trained staff to spot phishing.
Phishing rose 74% in 2024 and is one of the main routes in. The two controls are staff training and a second login factor. The forecasts cited below expected AI-written phishing to lift credential-theft success by around 40% by 2026.
Figure 4: Phishing for employee credentials, access to a cloud platform (Snowflake), call records extracted and posted on the dark web, then customer notification and new controls.
5. Dropbox sign (May 2024)
Dropbox Sign exposed customer email addresses, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA details.
The attackers reached the production environment through misconfigured access controls. The reporting cites over-permissive IAM policies and missing network segmentation, both of which automated configuration audits and strict access policies catch.
Misconfiguration is still the main cause of cloud breaches in SaaS platforms. Over 82% of breaches in 2024 involved cloud environments, mostly through misconfigurations and weak access controls.
Figure 5: Misconfigured access controls lead to unauthorized access and theft of authentication data, followed by new controls and customer notification.
6. Slim CD (September 2024)
Slim CD, a payment processor, lost card data on 1.7 million people.
Someone got into the payment processing systems and extracted customer card details. The reporting blames outdated encryption and a lack of tokenization. Card data sells for $5 to $50 a record on the dark web depending on what comes with it, which is why encryption, tokenization and transaction monitoring matter for any processor.
Payment providers are hit for the resale value of card data. The average cost of a data breach reached $4.88 million in 2024, a record.
Figure 6: Payment systems infiltrated, card data exfiltrated and sold on the dark web, fraudulent transactions follow, then notification and new controls.
7. MOVEit transfer (June 2024)
Over 2,000 organizations worldwide were affected and millions of records exposed through Progress Software's MOVEit Transfer file-sharing platform.
The flaw was CVE-2024-5806, a zero-day that let attackers bypass authentication. The exploitation scenarios included forced authentication through malicious SMB servers and impersonation of valid users on the system. The reporting also describes a SQL injection route to remote code execution.
Supply chain attacks through third-party software keep rising. That is the case for vulnerability management and secure development on the vendor's side, and for patch speed on yours. Forecasts in early 2025 expected AI-driven malware to become a dominant threat vector over 2025 to 2026.
Figure 7: A zero-day in MOVEit servers is found and exploited, authentication bypassed, data exfiltrated and posted on the dark web, then patches and notification.
The numbers behind the trend
- Credentials. Stolen or compromised credentials were used in 86% of breaches in 2024, up on earlier years. Forecasts expected AI-driven phishing to raise credential-theft success by an estimated 40% by 2026.
- Cloud. Cloud environments accounted for over 82% of breaches in 2024, through misconfigurations and weak access controls. Multi-cloud setups were expected to see more attacks on API weaknesses.
- Shadow data. One-third of breaches involved data outside central IT control, and shadow data breaches were predicted to grow by over 50%.
- AI in attacks. Attackers use AI for social engineering that gets past older detection. The same forecasts expected AI-driven malware to be a dominant vector over 2025 to 2026.
- Cost. The average breach cost $4.88 million in 2024, a record. Global cybercrime costs were forecast to reach $10.5 trillion a year by the end of 2025.
- Ransomware. Exfiltration before encryption is now the norm, and double extortion was expected to dominate ransomware operations through at least 2026.
Turning this into a detection and response plan
Every breach above ended with credentials, tokens or card data in criminal hands, and those get replayed against other sites. That replay is where a fraud detection layer earns its keep. Sensfrx scores each signup, login and payment from device, network and behavior signals, IP reputation included, so a password stolen in someone else's breach does not work on its own against your site.
IP whitelisting is a narrower control: only approved addresses reach an admin panel or an API. It shrinks the attack surface for systems with a known set of users, and it needs a risk assessment first so the allowlist does not lock out people who need access.
How IP whitelisting works and when to use it.
Whitelisting on its own does not stop stolen credentials used from an allowed address, so pair it with monitoring, an incident response procedure and a regular check that the controls still do what they did on day one.
The fraud response plan guide walks through that procedure.
What to do first
Three of the seven breaches above started with a password. Put a second factor on every login that reaches customer data, score logins for device and network risk so a valid password from a new place gets a second look, and train staff on phishing. Zero-trust architecture, encryption of sensitive data and configuration audits cover the rest.
References
[1] T. Team, "8 worrying cybersecurity statistics you need to know in 2025," Tech.co News, February 2025, accessed March 6, 2025. [Online]. Available: https://tech.co/news/cybersecurity-statistics-2024
[2] H. N. S. Team, "Major data breaches that have rocked organizations in 2024," Help Net Security, July 2024, accessed March 6, 2025. [Online]. Available: https://www.helpnetsecurity.com/2024/07/16/ data-breaches-2024/
[3] B. Team, "The biggest data breaches of the year (2024)," Bluefin News, July 2024, accessed March 4, 2025. [Online]. Available: https://www.bluefin.com/bluefin-news/biggest-data-breaches-year-2024/
[4] S. R. Team, "2024 cybersecurity safety report: Trends and insights," Cybersecurity Safety Report, January 2024, accessed March 6, 2025. [Online]. Available: https://www.stationx.net/cloud-security-statistics/
[5] V. Team, "82 must-know data breach statistics [updated 2024]," Varonis Blog, November 2024, accessed March 4, 2025. [Online]. Available: https://www.varonis.com/blog/data-breach-statistics/
[6] K. C. R. Team, "Authentication vulnerability in moveit transfer," Kroll Cyber Risk Blog, June 2024, accessed March 6, 2025. [Online]. Available: https://www.kroll.com/en/insights/publications/cyber/progress-moveit-transfer-cve-2024-5806