The Biggest Data Breach Settlements in History

Michelle Wilson - August 31, 2020

Not long ago, a breach that compromised the data of a few million people would have been big news. Now, breaches that affect hundreds of millions or even billions of people are far too common. A data breach is an incident that exposes confidential and protected information. This can mean the loss or theft of your social security number, your bank account, credit card numbers, personal information, passwords, and your email addresses.

As mentioned, this unfortunately happens all the time. We compiled a list of some of the biggest data breaches and settlements of the 21st century to take a deeper look.

What are the biggest data breaches and settlements?

With sensitive business data stored on local machines, on enterprise databases, and on cloud servers, breaching a company’s data has become as simple – or as complex – as gaining access to restricted networks. Now this didn’t just start in the digital age, there were some publicly disclosed data breaches in the 1980s and 90s.

Since then, laws and regulations have been put into place to provide stricter guidelines for companies and organizations handling sensitive data information. These regulations help craft a plan for all the requires safety measures, storage and use practices for handling this type of information. But unfortunately for us, these rules and guidelines don’t exist for ALL industries, and as you know, don’t completely stop data breaches from occurring.

2005 is the year of the first data breach to compromise more than 1 million records. DSW Shoe Warehouse experienced this in March 2005 and 1.4 million credit card numbers and names on those accounts. 2005 got even worse in June when hackers exposed almost 40 million credit card accounts from a payment processor called CardSystems Solutions.

Not surprisingly, most of the super big data breaches have happened more recently. Let’s take a look:

eBay – May 2014

In May 2014, eBay reported that their system has come under attack exposing their ENTIRE account list of 145 million users. This included all information such as names, passwords, and addresses. Apparently, hackers had the credentials of some top-level employees, and used those to get access. Luckily, financial information is kept separately and was not compromised, so there was no settlement called for.

Adobe – October 2013

Early October 2013, Adobe originally reported that hackers stole nearly 3 million encrypted customer credit card accounts, plus login data. Later that month, Adobe corrected the reports because more than 150 million username and passwords were taken for them. This hack also exposed customer names, passwords, and debit card information.

Because they violated the Customer Records Act and unfair business practices, they were ordered to pay $1.1 million in legal fees and an undisclosed amount to users to settle claims.

Equifax – July 2017

As you may already know, Equifax is one of the largest credit bureaus in the US. They announced that they failed to patch a known vulnerability in one of their websites with resulted in a data breach exposing 147.9 million customers. This included social security numbers, birth dates, addresses, and other personal information.

They were definitely at fault because of a detrimental error they missed, and subjected to a big settlement. A $575 million settlement that would allow affected customers to file claims for free credit monitoring for a year. In our option, they got off too easy.

Anthem – February 2015

Anthem reported that they had experienced a data breach that resulted in about 79 million people’s personal information getting hacked. This included social security numbers, addresses, email addresses, and their health ID number. They weren’t the only health benefit company that experienced a data breach, and thus were lumped into agreeing to a $115 million class action lawsuit.

This is just a small sample of data breaches that have affected millions of Americans. It’s almost impossible to keep track of everyone, and unfortunately, it’s very likely that your data has already been exposed in one.

What can you do in the meantime? Be proactive and keep an eye out for news about companies you have accounts or have done business with. The FTC has a news feed you can follow to keep track of recent occurrences.