8 of the biggest data breaches in US corporate history by records exposed

Corporate America has suffered some enormous data breaches, spilling billions of usernames, passwords and financial records into the open. Hackers, unsecured servers and outside vendors have each played a role, with fallout that sometimes took years to surface. Here are eight breaches ranked by how many records they exposed.

1. Yahoo data breaches: All Three Billion Accounts

Yahoo initially reported a far smaller number of hacked accounts after its 2013 breach came to light, but the company later disclosed that all three billion user accounts tied to the platform had ultimately been compromised, a revision that made this the largest data breach ever recorded by number of records exposed.

The exposed data included names, email addresses, birth dates, security questions and hashed passwords, and because the true scope stayed hidden for years while Yahoo was in the middle of being sold to Verizon, affected users had far less time than they should have had to change credentials and watch for fraud tied to the stolen information.

2. First American Financial Corporation data leak: 885 Million Documents Exposed

An unsecured section of First American’s own website let anyone view roughly 885 million mortgage records, exposing bank account numbers, Social Security numbers, wire transaction receipts, driver’s license images and other title-insurance paperwork dating back to 2003.

No password, login or special access of any kind was needed to browse the documents, meaning years of sensitive homebuyer financial details sat reachable to anyone who simply guessed the right web address, a lapse that regulators and security researchers later singled out as a basic, entirely avoidable failure of routine data protection practices.

3. 2018 Marriott/Starwood data breach: 500 Million Guest Records

Marriott revealed that hackers linked to Chinese state intelligence had lurked inside Starwood’s reservation system undetected for roughly four years, and the hotel giant initially said 500 million guest records had been exposed, including passport numbers, payment card details and detailed travel history.

The intrusion actually began before Marriott even acquired Starwood, meaning the hotel chain unknowingly inherited a breach that predated the merger itself, and guests learned only years later that their passport numbers and card information had been sitting exposed the entire time they stayed loyal to the brand and its many properties.

4. Target 2013 data breach: 110 Million Shoppers Hit

During the peak of the holiday shopping season in December 2013, hackers infiltrated Target’s point-of-sale systems through credentials stolen from a third-party vendor and stole payment card and personal data affecting up to 110 million customers nationwide.

The breach hit shoppers at the worst possible moment, right as millions were swiping cards for holiday gifts at registers across the country, and it pushed major retailers to accelerate the long-delayed shift toward chip-enabled cards and stronger point-of-sale security systems in the years that followed the incident and its costly aftermath for the company.

5. 2017 Equifax data breach: 147.9 Million Americans Hit

Hackers exploited a known but unpatched software flaw to breach the credit bureau’s systems in 2017, making off with private records of 147.9 million Americans, along with millions more people in Britain and Canada, according to the company’s own disclosures.

Because Equifax holds the financial histories used to approve mortgages, credit cards and auto loans, the stolen Social Security numbers, birth dates and home addresses gave criminals nearly everything needed to open new accounts in someone else’s name for years after the breach was first disclosed to the public and lawmakers.

6. Anthem medical data breach: 78.8 Million Patient Files

The health insurer disclosed that hackers had gained access to personal information on 78.8 million people stored across its databases, a figure Anthem raised in February 2015 as investigators worked to uncover the full scope of the intrusion.

Because the compromised databases held Social Security numbers, employment histories, income data and home addresses rather than medical treatment records, the breach left affected patients and employees exposed to identity theft and tax fraud for years, long after the health insurer had patched the underlying systems and networks involved in the intrusion.

7. Facebook–Cambridge Analytica data scandal: 87 Million Users Harvested

Facebook eventually confirmed that more than 87 million users had data harvested without proper consent, with over 70 million of those accounts belonging to people located in the United States alone, according to the company’s own later accounting of the scandal.

The data had originally been pulled through a seemingly harmless personality quiz app and then passed along to a political consulting firm, turning what looked like a small academic research project into one of the defining privacy scandals of the entire social media era for regulators, lawmakers and the public alike.

8. 2012 LinkedIn data breach: 6.5 Million Became 100 Million

LinkedIn first disclosed in 2012 that intruders had stolen about 6.5 million user passwords, but in May 2016 the company revealed that the same original breach actually included 100 million more email addresses and hashed passwords from the very same 2012 attack.

The four-year gap between the original disclosure and the far fuller accounting meant millions of additional users had no idea their credentials were circulating unnoticed, a delay that later became a cautionary example of how breach totals can quietly balloon well after the initial headlines fade from view entirely.