Between 2013 and 2026, some of the world's largest reported data breaches and exposures involved datasets ranging from 13.7 million to 26 billion records. These incidents revealed weaknesses in access controls, security configurations, credential management, monitoring, and incident disclosure. In several cases, information compromised in earlier incidents resurfaced in newly exposed datasets.

The biggest data breaches demonstrate how inadequate security controls and delayed incident responses can expose sensitive information on a massive scale. This article examines 10 major incidents, their reported causes, and the security or compliance gaps associated with each.

The cases are primarily arranged by reported data volume, with the most recent incident, Vibetech, appearing last. Record counts do not necessarily represent unique individuals, and some incidents involve disputed claims, data scraping, or aggregated information from earlier breaches.

At a Glance: The 10 Incidents

• MOAB

  Year: 2024

  Reported scale: 26 billion records

  Key distinction: Aggregated exposed dataset; reported firewall misconfiguration

• Cam4

  Year: 2020

  Reported scale: 10.88 billion records

  Key distinction: Unprotected Elasticsearch database; duplicates

• Yahoo

  Year: 2013

  Reported scale: 3 billion accounts

  Key distinction: Account intrusion; separate 2014 disclosure failures

• National Public Data

  Year: 2024

  Reported scale: 2.9 billion claimed rows

  Key distinction: Reported personal-data exposure; scope disputed

• Aadhaar

  Year: 2018

  Reported scale: 1.1 billion claimed records

  Key distinction: Disputed access allegations; credential controls

• Alibaba / Taobao

  Year: 2019–2020

  Reported scale: 1.1 billion data items

  Key distinction: Automated scraping over several months

• Ticketmaster

  Year: 2024

  Reported scale: 560 million claimed users

  Key distinction: Third-party cloud access; count unverified

• Sina Weibo

  Year: 2020

  Reported scale: 538 million claimed records

  Key distinction: Phone-number matching and scraping

• Facebook

  Year: 2021

  Reported scale: 533 million accounts

  Key distinction: Contact-importer scraping; GDPR enforcement

• Vibetech-linked repository

  Year: 2026

  Reported scale: 13.7 million records

  Key distinction: Exposed aggregate database; responsibility unestablished

Comparison note: Accounts, records, rows, and individual data items are different units. These figures should not be added together or interpreted as unique affected people.

What Is a Data Breach?

A data breach is a security incident in which an unauthorized party accesses, acquires, or discloses information maintained by an organization. Breaches may result from cyberattacks, compromised credentials, security misconfigurations, insider misuse, or vulnerabilities that allow unauthorized data extraction.

Data breach prevention involves technical and organizational safeguards to protect sensitive information. Applicable data breach laws establish notification and reporting obligations, while an organization's incident response policy defines how events should be identified, investigated, escalated, and managed.

History of Data Breaches: How Security Threats Have Evolved

• 1984: The TRW credit database incident is often cited as an early major exposure. A password posted on an electronic bulletin board reportedly enabled access to approximately 90 million credit histories.
• 1980s and 1990s: Telephone connections and shared terminals were common access points, with passwords frequently serving as the main barrier.
• 2000s: Networked databases increased the scale of potential exposure. California's SB 1386 took effect in 2003, introducing notification requirements for certain unauthorized acquisitions of unencrypted personal information.
• 2010s: Compromised credentials and third-party access became prominent risks. The GDPR became applicable on May 25, 2018.
• 2020s: Cloud storage, external platforms, and automated scraping introduced additional risks, while regulatory scrutiny increasingly addressed privacy by design.

Types of Data Breaches

Six common categories are external intrusion, credential compromise, security misconfiguration, insider misuse, third-party exposure, and data scraping. These describe different mechanisms; a single incident can involve more than one category.

1. MOAB: 26 Billion Records (2024)

In January 2024, researcher Bob Diachenko and Cybernews reported an exposed repository containing approximately 26 billion records across 12 terabytes. The collection incorporated thousands of earlier leaks and likely contained duplicates; it should not be described as 26 billion newly compromised accounts. Leak-Lookup later said it owned the dataset and attributed the exposure to a firewall misconfiguration. That explanation is the company's own account.

Reported security gap: Perimeter configuration and access protection for an aggregated data repository. Sources: Cybernews investigation

2. Cam4: 10.88 Billion Records (2020)

SafetyDetectives researchers reported an exposed Elasticsearch cluster associated with Cam4, containing approximately 10.88 billion records and more than seven terabytes of data. The information reportedly included names, email addresses, payment logs, chat transcripts, and other sensitive details. About 11 million records contained email addresses. Granity Entertainment reportedly secured the cluster after notification. Duplicate entries contributed to the reported total.

Reported security gap: Inadequate database access restrictions and configuration controls. Sources: WIRED reporting

3. Yahoo: 3 Billion Accounts (2013)

Yahoo disclosed a 2014 breach affecting more than 500 million accounts in September 2016. Verizon later disclosed that a separate 2013 incident affected approximately three billion accounts. The U.S. Securities and Exchange Commission found failures in Yahoo's investigation and disclosure handling of the 2014 incident, and Altaba agreed to a $35 million settlement without admitting or denying the SEC's findings. Those regulatory findings must not be conflated with the separate 2013 incident.

Reported compliance gap: Incident escalation and disclosure controls, specifically in connection with the 2014 breach. Sources: SEC enforcement release

4. National Public Data: 2.9 Billion Records (2024)

In April 2024, the threat actor USDoD reportedly offered a dataset of 2.9 billion rows for sale, allegedly including Social Security numbers. National Public Data acknowledged an incident involving attempted third-party access dating to December 2023. Its parent later referred to hundreds of millions of potentially affected individuals. The 2.9 billion figure describes claimed rows, not verified unique people; Have I Been Pwned characterized the breach as unverified and identified approximately 134 million unique email addresses. The precise extraction method remains unclear.

Reported security and compliance concerns: Protection of personal information and timeliness of incident notification; the root cause is not conclusively established. Sources: KrebsOnSecurity investigation | Have I Been Pwned entry

5. Aadhaar: 1.1 Billion Records (2018)

In January 2018, The Tribune reported that sellers on WhatsApp offered credentials for an Aadhaar-related portal for ₹500, allegedly providing access to information linked to more than one billion Aadhaar numbers. UIDAI disputed the account, denied a data breach, and said the search tool did not reveal biometric information. UIDAI subsequently restricted access for approximately 5,000 officials and introduced additional authentication requirements. The billion-record figure remains a reported claim, not an independently confirmed breach count.

Reported security concern: Credential issuance, authorized-user permissions, and access monitoring. Sources: UIDAI government response

6. Alibaba: 1.1 Billion Pieces of User Data (Taobao Scraping Case)

According to The Wall Street Journal's reporting on a Chinese court verdict, a developer used automated web-crawling tools beginning in November 2019 to extract more than 1.1 billion pieces of Taobao user data over approximately eight months. The data reportedly included user IDs, phone numbers, and comments. Alibaba detected the activity in July 2020 and notified authorities. The court convicted the developer and his employer and found Alibaba and Taobao had acted within the law.

Reported security gap: Interface safeguards against sustained bulk extraction. Sources: Alibaba SEC filing | Bloomberg report

7. Ticketmaster: 560 Million Records (2024)

In May 2024, ShinyHunters claimed to possess 1.3 terabytes of Ticketmaster information involving 560 million users. The user count originated with the threat actor and was not confirmed by Ticketmaster. In a May 31 SEC filing, Live Nation confirmed unauthorized activity in a third-party cloud database environment containing Ticketmaster data. Subsequent reporting linked the campaign to compromised credentials and accounts lacking multi-factor authentication.

Reported security gap: Identity and access management in a third-party cloud environment. Sources: Live Nation SEC filing

8. Sina Weibo: 538 Million Records (2020)

In March 2020, listings offered data allegedly covering 538 million Sina Weibo accounts, including phone numbers associated with approximately 172 million users. Weibo acknowledged an exposure and said unauthorized software abused its phone-number-based friend discovery function. A security representative attributed the incident to automated matching in 2019, although experts questioned aspects of that explanation. Chinese authorities directed the company to strengthen security.

Reported security gap: Automated matching and bulk extraction through account-discovery features. Sources: Weibo SEC filing

9. Facebook: 533 Million Records (2021)

In April 2021, information associated with approximately 533 million Facebook accounts appeared on a cybercrime forum. Facebook said the data had been scraped through contact-importer functionality before September 2019 and that it addressed the issue in August 2019. In November 2022, Ireland's Data Protection Commission found infringements of GDPR Articles 25(1) and 25(2), concerning data protection by design and default, and imposed fines totaling €265 million.

Confirmed compliance gap: Inadequate privacy-by-design and privacy-by-default safeguards in the functions examined by the regulator. Sources: Irish Data Protection Commission decision

10. Vibetech: 13.7 Million Records (2026)

Researcher Jeremiah Fowler reported a database without password protection or encryption containing approximately 13.7 million records from earlier breaches. The data reportedly included names, email addresses, passwords, and banking-related information. Fowler associated its IP address with infrastructure linked to Vibetech, an India-based AI software company. Cybernews noted that the relationship between the company and the database was not established. Fowler did not allege wrongdoing by Vibetech. ExpressVPN published the report on October 12, 2026.

Reported security gap: Missing access controls on an aggregated repository; responsibility remains unestablished. Sources: TechRadar coverage

Root Causes Behind the Ten Biggest Data Breaches

The ten incidents examined in this article demonstrate how weaknesses in access management, security configurations, data protection controls, and incident response processes can contribute to large-scale data exposure.

Cases involving MOAB, Cam4, and the repository linked to Vibetech highlight the risks associated with inadequately protected databases. The Aadhaar and Ticketmaster incidents raise concerns about credential management and access restrictions, while Alibaba, Sina Weibo, and Facebook demonstrate how automated data extraction can expose information through legitimate application features.

Yahoo and National Public Data also illustrate the importance of incident investigation, escalation, and timely disclosure.

Although the circumstances and regulatory findings differ across these incidents, they reinforce a common principle: organizations need clearly defined security controls, continuous monitoring, and effective incident response procedures to manage information security risks.

How CertPro Supports Independent Security Control Assessments

CertPro is an independent, licensed CPA firm that conducts SOC 2 examinations in accordance with applicable AICPA attestation standards. Learn more: CertPro official website

Our auditors independently evaluate controls relevant to the selected Trust Services Criteria, which may include security, availability, processing integrity, confidentiality, and privacy, depending on the engagement scope.

A SOC 2 examination provides an independent opinion on controls within the defined system and reporting period. While it does not eliminate cybersecurity risks, it helps organizations demonstrate the design and, where applicable, operating effectiveness of relevant controls.