In 2024 major data breaches made global headlines, exposing more than a billion records and affecting critical industries. Each of these incidents revealed specific vulnerabilities such as weak third-party controls, poor password management, and inadequate access controls that left organizations needlessly open to attacks.
These breaches serve as a stark reminder that the cybersecurity landscape is constantly evolving and that threat actors are quick to exploit even minor security lapses. By understanding the tactics used by attackers and assessing the impacts of these breaches, businesses can make more informed decisions to safeguard their data.
Below, we examine the five biggest data breaches of 2024, analyze what went wrong, and identify the practical steps organizations can take to strengthen their defenses in 2025.
1. National Public Data Breach: 2.9 Billion Records
National Public Data, an online background check and fraud prevention service, experienced a significant data breach when cybercriminals discovered a zip file on the NPD website with plain text usernames and passwords needed to access the database. Sensitive data, including names, social security numbers, phone numbers, and physical and email addresses, were leaked on the dark web starting in April 2024.
Approximately 170 million US and Canadian citizens were affected by the incident and the owner of NPD is now facing more than a dozen lawsuits related to the breach.
Takeaway: Conduct Routine Security Audits
Routine cybersecurity audits are crucial for catching vulnerabilities before attackers can exploit them. Many breaches, like National Public Data’s, stem from simple misconfigurations that could have been identified with regular security checks.
Conduct periodic internal audits: Performing routine cybersecurity audits, vulnerability scans, and penetration tests help organizations catch emerging risks, misconfigurations, and overlooked security gaps. Annual or even more frequent audits are essential for identifying and addressing weaknesses quickly, especially as growing companies onboard new vendors, personnel, systems, and processes.
Implement continuous monitoring: Continuous monitoring tools integrate with your systems to flag misconfigurations or failing security controls, allowing organizations to proactively resolve issues before they become exploitable weaknesses or non-compliance issues.
Adopt a security framework: Implementing recognized security frameworks like NIST CSF, SOC 2, or ISO 27001 helps align your efforts with best practices, with many frameworks requiring regular audits for compliance. These external audits provide third-party assurance that your security controls meet industry standards, offering an extra layer of confidence in your security posture.
2. AT&T Breaches: 50 Billion+ Records
AT&T experienced multiple data breaches in 2024 that exposed customer contact details and account-related information due to vulnerabilities in third-party vendor systems. In March, a data breach broker stole 73 million customer records, including names, phone numbers, and addresses, as well as encrypted account passcodes, and published them online.
In a second breach, hackers accessed AT&T customer data stored on Snowflake, exploiting stolen credentials from data engineers who had access to their employer’s Snowflake environments. Criminals stole the records of “nearly all” of AT&T’s cellular and landline customers — approximately 50 billion customer call and text records in total.
Takeaway: Prioritize Third-Party Risk Management
The AT&T breaches underscore the importance of strong vendor risk management practices. Organizations must take steps to reduce their third-party risk exposure moving into 2025.
Conduct thorough vendor risk assessments: Organizations should evaluate their vendors’ security practices to assess risk and ensure alignment with security standards. This includes reviewing any compliance certifications, checking for encryption standards, and verifying that vendors have strong access controls and incident response plans in place.
Limit vendor data access: Restrict vendors’ access to only the data they need to perform their services. Whenever possible, anonymize or mask sensitive information to minimize exposure, ensuring that third-party providers don’t have unnecessary access to sensitive customer or company data.
Establish security requirements and SLAs in vendor contracts: Include clear security expectations in all vendor contracts, specifying incident reporting requirements and any periodic audit requirements.
Use automation to monitor vendor compliance: GRC automation tools can continuously monitor third-party compliance and security practices, giving you better visibility into vendor risk and a single tool to manage risk across your ecosystem.
3. Ticketmaster Breach: 560 Million Records
Between April and May 2024, attackers managed to exfiltrate 1.3 terabytes of data from Ticketmaster after they gained access to a cloud database hosted by third-party data services provider Snowflake. Leaked data included customer names, email addresses, payment information, and purchase histories.
The breach went undetected for nearly seven weeks, delaying Ticketmaster's regulatory notification until June 28. Customers were not made aware of the breach until mid-July — almost two months after it had been discovered.
The incident and Ticketmaster’s delayed response has led to significant fallout, affecting over 40 million users and leading to multiple lawsuits, including class action suits and filings from the U.S. Justice Department against Ticketmaster’s parent company, Live Nation.
Takeaway: Continuously Monitor Your Control Environment
Continuous monitoring provides organizations with the visibility needed to detect and respond to potential threats promptly, minimizing the impact of a breach.
Implement real-time monitoring and alerts: Real-time monitoring tools detect unusual activity patterns, such as sudden spikes in login attempts or unexpected access locations. These tools give organizations instant visibility into potential threats, enabling fast responses to suspicious behavior.
Leverage AI for faster vulnerability remediation: AI-based tools like Secureframe’s Comply AI for Remediation can generate fixes for infrastructure as code that are tailored to your environment, helping teams quickly fix failing controls and close security gaps before they’re exploited.
Set up anomaly detection: Machine learning algorithms can identify deviations from normal patterns, signaling unauthorized access or data misuse. Alerts can allow security teams to act immediately, quickly containing a suspected breach and limiting its impact.
4. Change Healthcare Breach: 145 Million Records
In February 2024, Change Healthcare suffered the largest known data breach of protected health information to date, affecting more than 100 million Americans. The breach exposed Social Security numbers, drivers license numbers, medical records, insurance data, and financial and banking records — and caused widespread disruptions in processing payments and prescriptions across the US healthcare system.
The parent company of Change Healthcare has faced significant financial repercussions, with direct response costs totaling $1.5 billion and overall cyberattack impacts reaching $2.4 billion, including a $22 million ransomware payment made in exchange for a promise to destroy the stolen healthcare data.
The breach was caused when attackers either stole or purchased credentials for a Citrix portal used for remote access to Change Healthcare systems, which did not have multi-factor authentication in place.
Takeaway: Strengthen Access Controls
The absence of foundational security measures like MFA in this case illustrates how crucial strong access controls and periodic access reviews are to preventing unauthorized system access.
Require MFA across all sensitive systems: MFA is essential for protecting systems with sensitive information, especially those accessed remotely. For high-risk roles, consider advanced methods like biometrics or hardware tokens to further strengthen security.
Implement the Principle of Least Privilege: Limit access rights so that employees and vendors only have access to the data necessary for their role or job function. Reducing unnecessary access minimizes the potential damage if an account is compromised.
Conduct regular access reviews: Periodically review and adjust user permissions to ensure they reflect current job functions. This step helps prevent excessive or outdated access and reduces the risk of insider threats.
Monitor for unauthorized access attempts: Use real-time monitoring to detect suspicious login behavior, such as multiple failed attempts or unusual access locations. Quick detection allows organizations to respond before unauthorized access becomes a full-blown breach.
5. Dell Breach: 49 Million Records
Dell Technologies experienced a significant data breach this year in which attackers gained access to customer information, including names, email addresses, and hashed passwords. This breach originated from a brute-force attack launched after a hacker accessed a client portal via one of Dell’s resellers. The attacker then sent over 5,000 login requests per minute for nearly three weeks, totaling almost 50 million attempts, yet Dell’s systems failed to detect this activity. It was only after the hacker sent multiple emails to Dell about the security vulnerability that the company became aware of the breach.
Takeaway: Strengthen Vulnerability Management
The Dell breach underscores the importance of proactive vulnerability management to detect and address security gaps before attackers can exploit them. Effective vulnerability management ensures that organizations can quickly detect and respond to unusual activity, protecting their systems and data from persistent threats like brute-force attacks.
Establish a vulnerability management policy: A vulnerability management policy defines your organization’s approach to identifying, prioritizing, and remediating vulnerabilities. This policy provides a structured process for implementing a vulnerability management program that’s consistent across your organization, with defined roles, responsibilities, and timelines for each stage of remediation.
Use automation to enhance efficiency: Resourcing constraints are a common challenge in effective vulnerability management. Automated tools can streamline the process by continuously scanning for misconfigurations, monitoring the health of IT assets, and providing alerts for newly identified vulnerabilities. Platforms that incorporate AI for cloud remediation can also help mitigate vulnerabilities faster and more efficiently.
Conduct regular vulnerability scans and penetration testing: Periodic security assessments and penetration tests simulate real-world attacks to uncover potential vulnerabilities and identify the most likely attack vectors. These proactive assessments can help your organization strengthen its defenses by identifying specific areas for improvement.
Cybersecurity Best Practices for A More Secure 2025
The major data breaches of 2024 have revealed the consequences of overlooked vulnerabilities, from third-party risk to weak access controls. By adopting the lessons learned from these incidents, organizations can strengthen their defenses and protect sensitive data.
In addition to the key takeaways outlined above, organizations should take these essential steps to reduce exposure, improve incident response, and enhance their overall resilience.
Reduce Exposure with Data Minimization
Minimize your data exposure by collecting and retaining only the essential personal information necessary for operations. By limiting the data stored and protecting what is retained, organizations can significantly reduce the impact of potential breaches.
Regularly assess the types of data collected and ensure they align with specific business needs. Limit exposure to sensitive data like Social Security numbers unless absolutely necessary. It’s also important to establish specific data retention and disposal policies that define how long different types of data should be retained and methods for secure disposal.
Stress Test Your Incident Response Plan
An effective incident response plan can mean the difference between quick containment and a prolonged crisis. With a well-prepared incident response plan, organizations can manage breaches efficiently, minimizing damage and fostering a culture of resilience.
Make sure your incident response plan clearly outlines the steps for identifying, containing, and mitigating a breach, with assigned roles and responsibilities and communication protocols. Conducting regular training and simulations can help ensure teams are prepared to act quickly and decisively in the event of an actual incident and that any issues with your incident response procedures can be identified and addressed.
Build a Culture of Security and Privacy Awareness
Incorporating security best practices into daily operations is essential. This includes regular security awareness training that reflects evolving threats and tactics and informs personnel of the key role they play in protecting the organization and its customers. Simulated phishing campaigns, for example, can test employees’ ability to recognize phishing attempts and provide targeted follow-up training for those who fall for simulated attacks. Organizations should customize training based on employees’ specific roles and the types of data they access so employees understand the specific security practices relevant to their responsibilities.
Building a security-aware culture extends beyond employee training — security should be integrated into every aspect of your operations. This starts with encouraging open communication around security practices, updates on the current threat landscape, and specific security measures. These steps help employees feel confident in recognizing and reporting potential threats without hesitation.
Another essential element is a well-defined incident reporting process that’s easy for employees to access and understand. Organizations should make it clear that reporting suspicious activity or potential breaches is not only supported but actively encouraged. Establishing secure, anonymous channels for incident reporting can further enhance transparency, making employees more likely to report unusual or suspicious activity.
Implement a GRC Automation Solution
A Governance, Risk, and Compliance (GRC) automation platform is a powerful tool that enables organizations to strengthen their overall security and compliance program. By automating routine tasks and centralizing critical compliance functions, these solutions streamline processes that are traditionally time-consuming and prone to human error. Automation provides continuous visibility into risk levels and control performance, helps organizations proactively identify and address vulnerabilities, and simplifies regulatory and security compliance.
Secureframe is a GRC automation solution for companies aiming to build a resilient, comprehensive security and compliance program. Continuously monitor your tech stack to identify and remediate vulnerabilities and automate risk assessments to stay ahead of potential threats. With comprehensive third-party risk management features and automated compliance with 40+ frameworks, Secureframe can set your organization up for a secure and resilient 2025. Learn more at secureframe.com
Forward Future Takeaways: Preparing for a Secure 2025
The data breaches of 2024 reveal critical gaps in cybersecurity, from weak access controls to poorly managed third-party systems, underscoring the need for organizations to adopt a proactive, layered defense strategy. Prioritizing foundational measures like mandatory multi-factor authentication (MFA), the principle of least privilege, and regular security audits can dramatically reduce internal vulnerabilities. At the same time, robust vendor risk management practices, including pre-contractual due diligence, limiting data sharing, and continuous compliance monitoring, are essential as third-party vulnerabilities increasingly emerge as entry points for attackers.
Real-time monitoring, AI-driven anomaly detection, and automated response tools will play a crucial role in combating increasingly sophisticated threats. However, the rise of AI is a double-edged sword: while it enables faster detection and remediation, it also empowers threat actors to automate attacks, develop advanced malware, and exploit vulnerabilities at scale. This duality requires businesses to use AI strategically, implementing tools that monitor for anomalies, secure cloud environments, and respond to incidents more efficiently. Resilience will also hinge on comprehensive incident response planning, regular crisis simulations, and fostering a culture of security awareness through tailored employee training and open communication.
Finally, organizations must rethink their data strategies, minimizing the collection and retention of sensitive information while investing in GRC (Governance, Risk, and Compliance) automation to streamline compliance with evolving regulations. These measures, coupled with a commitment to adopting AI responsibly, can help organizations better navigate an increasingly complex threat landscape. Cybersecurity in 2025 demands adaptability, vigilance, and a balanced approach to leveraging advanced technologies while guarding against their misuse.
FAQs
What is the major data breach in 2024?
In 2024, one of the most significant data breaches involved National Public Data (NPD), a company specializing in background checks and fraud prevention. Cybercriminals gained access to the sensitive information — including names, Social Security numbers, phone numbers, and addresses — of nearly 3 billion individuals. This breach has resulted in multiple lawsuits against NPD's owner.
What is the biggest data breach in history?
The largest data breach occurred in 2013 when Yahoo suffered an attack that compromised approximately 3 billion user accounts. The breach exposed user information such as names, email addresses, telephone numbers, dates of birth, and hashed passwords.
