If you have been paying attention to the news in recent years, you may have noticed that cyber-crime is on the rise. Between cyber extortion, data leaks, malware spreads, and hacking, law enforcement have their hands full. Some cyber-attacks, though, are so terrible that they devastate millions of people.
What was the biggest cyber-attack? There are different ways to measure the damage, which makes it hard to nail down one specific attack. Some of the worst include:
- The Morris Worm
- WannaCry
- The Equifax Breach
- The Ashley Madison Breach
- MafiaBoy
- The Million Credit Card Heist
- The NASA/DoD Hack of 1999
- The 2002 Internet Hack
- Solar Sunrise
- The Yahoo Leak
Trying to figure out the worst of the worst is hard, to say the least. This list will give you the wild stories behind each cyber-attack and explain why each attack was so devastating in its own way.
What Was the Biggest Cyber-attack?
There are many ways to define a major cyber-attack, which makes this question somewhat challenging to answer. How “big” a cyber attack is can be defined by several different factors, including:
- Damage to the Internet
- Financial Damage
- Number of People Affected
- Damage to Governments
- Damage to Individual People
- Potential Loss of Life
It is hard to gauge the full extent of the damage, but what we can say is that the attacks below were particularly terrible for everyone involved.
How Do Courts Treat Cyber-crimes?
Though cyber-crimes tend to carry out serious damage to financial institutions, individual people, and governments, authorities often do not sentence criminals to significant jail time. In many cases, cyber criminals who are caught may only serve a couple of years in prison despite the havoc they wreak.
The Morris Worm (1988)
The Morris Worm was one of the very first cyber-attacks ever to happen, which makes it both a historical attack and an attack that ushered in the need to protect the net from future problems. This attack was launched by Cornell University student Robert Tappan Morris in 1988.
The worm itself was not meant to be harmful. Instead, it was a study to see how vast the internet was by mapping out the paths it took to transmit data. The problem was that there was a glitch in the program that caused it to morph into a virus. The virus quickly began infecting every single computer it came into contact with, rapidly replicating itself.
Around 6000 computers crashed due to the Morris Worm. Though this might not sound like a big deal by today’s standards, it was massive in the 1980s and almost caused the entire internet to grind to a full standstill.
How Much Was the Damage?
The Morris Worm cost the world a pretty penny, clocking in anywhere from $10 million to $100 million in estimated damages around the world. The more significant damage it caused was the inspiration for cyber-attacks that would later be known as DDoS attacks.
Though this was technically a mishap, the Morris Worm kicked off the start of cyber-attacks as we know it. Because it helped contribute to the general design of a standard DDoS attack, the Morris Worm became damaging due to the legacy it sparked rather than the actual financial loss.
WannaCry (2017)
Fast forward approximately 30 years, and we entered a world that was filled to the brim with internet use. Millions of computers were made every month, and most banking activities are done via the internet. Hackers knew this well and created a special ransomware attack designed to destroy the economy.
The WannaCry attack was a ransomware attack made by cyber criminals that targeted banks and companies. The attackers used the EternalBlue exploit created by the NSA to enter older Windows systems. While there was a patch to the exploit, many companies never updated their systems.
The hacker group demanded a massive payment in Bitcoin in order to cease the virus’s destruction. It was only after authorities found a built-in killswitch that the attack was quelled. Multiple countries’ investigations led authorities to believe it was an attack done by North Korea.
How Much Was the Damage?
Tallying up the full extent of WannaCry’s devastation is difficult, but we are going to tally up the damage best we can below:
- Over 200,000 computers were infected. These include personal computers as well as company computers.
- NHS and other hospitals had to turn away patients. Their computer systems were crippled by WannaCry and needed to be revamped. This led to the deaths of hundreds of people as well as a national scandal involving Britain’s NHS.
- It is estimated that WannaCry caused anywhere from hundreds of millions to billions of dollars’ worth of damage. Because losses included payments for cyber security teams as well as repairs, no one knows the full extent of the damage. CBS [1] noted that their total estimate for the financial damage of WannaCry resulted in a $4 billion loss.
- The attack also caused damage in the form of locking people out of their information, thereby eating up time that could be used on more important matters. Doing so reduced people’s productivity.
The Equifax Breach (2017)
2017 was not a good year for computer safety. Along with the WannaCry malware breakout, American credit score company Equifax announced that hackers had breached their systems and obtained the personal information of over 143 million United States citizens.
The breach involved the personal information of millions, as well as the credit card information for over 200,000 accounts. Equifax did not handle it well. Many executives knew of the breach and sold off stock before it was publicly announced, leading to accusations of insider trading.
How Much Was the Damage?
Equifax never regained the reputational damage it had endured during the attack, and many of the executives were called to resign after their insider trading was made public. Here is the scoop on what happened, just for starters:
- 143 million people affected. This is approximately a third of all American citizens.
- 200,000 credit card accounts compromised. This makes it one of the most massive credit card breaches in history.
- Over $425 million in identity theft-related losses. This is only a fraction of the financial damage.
- A $575 million lawsuit settlement[2]. Individuals affected by the breach sued the company.
- Countless hours of lost work. There is no precise estimate regarding how much work had to be done to recover everything.
The Ashley Madison Hack (2015)
Perhaps one of the most ethically ambiguous cyber-attacks to become legendary in scale dealt with the affair-finding website known as Ashley Madison. This site claimed to keep your search for affairs secret, and to wipe your information for an added fee.
A group of hackers known as “The Impact Team” breached the site’s data and stole all the information of users on the site. This led to thousands of philanderers being caught, including several celebrities—including Josh Duggar.
How Much Was the Damage?
Along with being a clear cause of divorce for countless couples, the Ashley Madison hack ended up causing serious scandals in Hollywood for the 20 Kids and Counting crew. That aside, let’s look at the damage tally:
- 1200 Saudi Arabian accounts were exposed. This doesn’t sound too bad until you realize that adultery can be punishable by death. Gay men[3] in other countries have also been exposed to similar dangers from the leak. Many victims are now facing flogging, jail time, and executions as a result of being named in the attack.
- Hundreds of users reported being targeted by cyber-extortionists. They were told to pay hundreds of dollars in Bitcoin or to get their affairs exposed to their families. Many paid the money, but it’s unsure how many people were victimized.
- The damage resulted in a $567 million-dollar class-action lawsuit against Ashley Madison. The battle raged on for a year, until Ashley Madison announced they would settle for $11 million.
- Two suicides were allegedly linked to the breach. These are unconfirmed [4]but are deemed highly suspicious by police. Both men who were found dead from suicide were approached by extortionists who threatened to tell their families about their indiscretions. Whether this was the final straw for them remains to be seen.
- There has also been one confirmed suicide[5] linked to the breach. The deceased was a pastor who could not live life with a tarnished reputation in his community.
- Millions of accounts were exposed, including many fraudulent ones. This basically ruined what was left of the site’s reputation. Around 86 percent of all women’s accounts were found to be false and made in-house.
- Ashley Madison never fully recovered from the breach. Once a highly profitable company, the site lost almost all its users after it was revealed they never deleted the information on past users despite the fees people paid. While the site is still active, it is clearly struggling.
The MafiaBoy Attack (2000)
Leave it to a 15-year-old kid who is bored out his mind to cause one of the worst cyber-attacks in modern history. The MafiaBoy attack was a massive DDoS attack that was launched at several major websites, including high-end sites like Amazon, eBay, and CNN.
The DDoS attack was named Rivolta, and rapidly fired communications to the sites until they were not able to respond to all the calls. At one point, Rivolta took down Yahoo for an entire hour. Most of the sites suffered serious damage that resulted in a massive loss of income.
The attack was traced to a small Canadian town, where the culprit was discovered to be a teenager by the name of Michael Calce. Since he was a minor, he was only given eight months of open custody, a year of probation, and a fine.
How Much Was the Damage?
Unlike other attacks on this list, the damage with the MafiaBoy attack’s losses were almost entirely financial. The price tag that the attack ran up, though, is so impressive that it’s hard to ignore. Reporters estimated that Calce’s attack $1.2 billion in United States dollars.
The Million Card Heist (2009)
One of the easiest ways to cause severe damage in cyber space is to obtain financial information that can be used to create fraudulent charges on the dark web. In 2009, Miami-based hacker Albert Gonzalez broke into the networks of over 250 different financial institutions and walked away with millions of credit card profiles.
The credit card details that were leaked affected almost every major bank, not to mention multiple major retail chains. Gonzalez and his accomplices used spoofing, packet sniffers, and SQL injections to harvest the information. Once he got the credit card details, he resold the information on the dark web.
Gonzalez was already on the radars of federal investigators and the Secret Service after he was arrested for smaller hacking attempts earlier on. When investigators uncovered the attacks, they realized that Gonzalez was running an international theft ring. He was sentenced to 20 years in prison.
How Much Was the Damage?
This massive heist was a financial crime rather than a crime that involved loss of life or scandal. It took a heavy toll on innocent people and companies alike:
- Millions of credit cards were stolen and sold on the internet. Federal investigators still aren’t entirely sure how many credit cards Gonzalez and his crew poached. Approximately 130 million credit card numbers were stolen from Heartland Payment Systems alone.
- Heartland lost $12.6 million. This sum also included the legal fees the company needed to battle Gonzalez in court.
- The number of fraudulent charges totaled $200 million, at the very least. Much like with the exact number of cards that have been stolen, authorities have not been able to confirm the full extent of the damage on this end.
- There was also tax revenue lost as a result of money laundering activities tied to the card sales. Though this is a small sliver of the problem, it is still something to consider.
The NASA/Department of Defense Attack (2009)
When it comes to cyber-attacks, few types of attack targets inspire as much fear and panic as actual government agencies. These kinds of attacks pose a serious threat to human life, and if not disabled, could potentially lead to weapons being set off remotely by hackers who just want to tear the world down.
In 2009, we came scarily close to seeing something terrifying happen. The hacker in question was 15-year-old Johnathan James. On a whim, James decided to hack into the Department of Defense’s division and installed a backdoor on its servers. From there, he was able to read thousands of emails of employees—all carrying serious government data.
He then hacked into NASA, where he promptly stole some highly prized software. The software in question was in charge of regulating the International Space Station’s environment. He was apprehended but given a light sentence due to his young age.
How Much Was the Damage?
With this attack, the damage potential could have been far worse. So, while it was still terrifying, we should be thankful that no astronauts were killed due to the software being hijacked. We should probably also be grateful that we did not end up in war.
The damage report was still immense:
- The stolen NASA software cost $1.7 million. The space agency also had a $41,000 loss due to being forced to shut down their systems for three weeks due to repairs.
- The attack also caused a massive uproar in the cyber security world. The hack caused widespread panic in the homeland security division of our country’s military.
- Months of work had to be done to repair the security loopholes and fix everything that was breached. This added workload took away from other important work that DoD employees had been dealing with.
The Internet Attack (2002)
The internet is almost entirely based on root servers—servers that basically control and direct most of the traffic the world has by parsing out domain names. In America, there were 13 domain name system root servers in 2002.
This year saw a concentrated cyber-attack geared towards disabling each server through an hour-long, large-scale DDoS attack. This brought the internet to its limits for an entire hour. Authorities have never found the culprit and called it one of the most complex cyber-attacks in history.
How Much Was the Damage?
This extremely complex attack almost took down the entire internet. In 2002. That is a massive blow, no matter who you are. Because so much of our world is enmeshed in the internet, the potential damage it could have brought simply cannot be measured.
Solar Sunrise (1998)
Back in the earlier days of the net, cyber-attacks were far more doable than they are now. In 1998, America’s national security became a victim of one of the most devastating, systematic attacks on government data network security teams have ever witnessed.
The attack involved breaking into over 500 government and private computer systems, then taking complete control of them. The attack was so thorough that the United States government was convinced that the country was under attack and that we were on the brink of war.
The systems that were victimized were heavily monitored, and included major names like the U.S. Navy, the Department of Defense, the Pentagon, and the U.S Air Force. A quick glance would make most people assume it was a declaration of war.
American systems were not the only ones targeted, though. Israeli universities like ComTec and Dharma were targeted, along with the computer of the Israeli president. The United States assembled a task force consisting of the NSA, FBI, and DoD to uncover the culprit.
They initially believed the culprit to be the Iranian government, but it was a 19-year-old hacker named Ehud Tenenbaum. Tenenbaum claimed he wasn’t trying to harm anyone, but rather prove that the networks’ security was flawed. He was sentenced to 1.5 years in prison.
How Much Was the Damage?
Where does one even begin with a cyber attack this large? It’s hard to tell. Here is the bare minimum that we were able to unearth in terms of damage:
- Over 500 compromised computer systems, many of which included hundreds of computers. This led to massive amounts of damage that had to be ameliorated by hundreds of cyber security experts. The sheer amount of money and time fixing the security holes is not known to the public.
- International relations remained strained for years after different countries were wrongly fingered for the damage. This, too, does not have a price tag on it.
It’s also worth noting that the Solar Sunrise debacle was not his last attack. He was later arrested for the theft of millions of dollars via computer hacking. So, maybe his tale about trying to expose weaknesses in systems was not the full truth.
The Yahoo Leak (2013-2014)
Though it is hard to imagine these days, there was a time when Yahoo was one of the largest search engines in the world. The site had millions of accounts stored on it, including many accounts that were linked to peoples’ names, addresses, phone numbers, and banking information.
By the mid-2000s, there was already a decline in the site’s reputation for security. Many individual accounts were being hacked, and the site just wasn’t keeping up with the times. There had already been several major breaches, but nothing like what was going to be announced in the years of 2013 and 2014.
In 2014, the executives at Yahoo had an announcement. They revealed that a total of 500 million accounts were hacked within the past year—and that almost all the data associated with it was compromised.
Five hundred million accounts being hit by the attack alone was bad, but the news was still going to get worse. In 2018, Yahoo’s team admitted that they lied about the breach. The exact number of compromised accounts was three billion, which meant that every single Yahoo mail account was hacked in 2013.
Yahoo noted that the attack appeared to be “state-sponsored,” but they have never come forth to say which country was behind the attack. It was later revealed that the FBI arrested four men, two of whom were Russian agents, in connection with the breach.
How Much Was the Damage?
There is no way to mince words when it comes to the size of the data breach. With a total of 3 billion accounts compromised, Yahoo suffered the most significant data leak in the history of the internet. Here is the full run of what was involved:
- Almost all personal information given to Yahoo by users was involved. This included names, birth dates, hashed passwords, answers to security questions, banking information, and phone numbers. If it was linked to a Yahoo account, it was leaked.
- The company is currently facing multiple lawsuits[6] associated with the breach. The leak affected millions of businesses, as well as the lives of major celebrities. Twenty-three lawsuits were filed in total.
- Yahoo has already been ordered to pay a total of $117.5 million as part of a massive class-action settlement. The companies behind Yahoo had initially tried to offer $50 million for the breach. The judge presiding over the case rejected it.
- The leak also impacted the company’s sale price. Yahoo was expected to be bought for $4.8 billion by Verizon. By the time the deal went through in 2017, the company was only valued at $4.47 billion.
- We still do not know how many businesses were impacted by Yahoo’s breach. It is safe to say that the damage the leak did to Yahoo-based storefronts cost hundreds of millions. However, the exact number of losses has never been tallied up.
- Yahoo’s reputation went into freefall after the incident. Though the company was struggling to keep a reputation for being secure, there was still a small chance for recovery prior to the leak. The damage from the Yahoo breach was deemed to be a significant nail in the company’s coffin.
Conclusion
Regardless of how you define “biggest,” there is a clear trend when it comes to cyber-attacks. In order to make a cyber attack that hits news headlines and becomes legendary in its own right, a lot of damage has to be done.
Cyber-attacks rarely, if ever, are only financial in nature these days. Along with the money losses people incur from having their data leaked or their website attacked, the damage that a single attack can bring has the potential to end human lives, force people out of work, and also ruin their relationships.
What is terrifying about these attacks is that most network security experts agree that we should expect other attacks that are just as bad as the ones we mentioned—if not worse. If you really think about it, it makes sense that so many companies are now putting digital security at the forefront of their businesses.
References:
[1] https://www.cbsnews.com/news/wannacry-ransomware-attacks-wannacry-virus-losses/
[2] https://www.consumer.ftc.gov/blog/2019/07/equifax-data-breach-settlement-what-you-should-know
[3] https://globalnews.ca/news/2186587/where-1296-gay-ashley-madison-users-face-prison-flogging-execution/
[4] https://www.bbc.com/news/technology-34044506
[5] https://money.cnn.com/2015/09/08/technology/ashley-madison-suicide/
[6] https://en.wikipedia.org/wiki/Yahoo!_data_breaches
