List of Data Breaches and Cyber Attacks in November 2022 – 32 Million Records Breached
Welcome to our November 2022 review of data breaches and cyber attacks. We identified 95 security incidents throughout the month, accounting for 32,051,144 breached records.
Almost half of that figure comes from two incidents. The first was a data breach at Twitter, in the latest PR disaster for the social media giant. Reports emerged late last week that user records were stolen using an API vulnerability that has since been fixed.
The second was a cyber attack on the Russian scooter-sharing service Whoosh, which was discovered after customers’ data was put up for sale on the dark web.
As always, you can find the full list of data breaches and cyber attacks below, divided into their respective categories.
Meanwhile, be sure to subscribe to our Weekly Round-up to receive the latest cyber security news and advice delivered straight to your inbox.
Contents
Cyber attacks
- Dropbox admits private GitHub repos were copied after phishing attack (unknown)
- Cryptocurrency platform Deribit hit in $28 million scam (unknown)
- Personal Paraguay telecom victim of cyber attack (unknown)
- Brazilian health insurance firm Fisco Saúde hit by cyber attack (unknown)
- ALMA Observatory shuts down operations due to a cyberattack (unknown)
- Cyber attack at Supeo disrupts trains in Denmark (unknown)
- Boeing subsidiary Jeppesen’s services hit by cyber attack (unknown)
- Cyber attack at a NY-based administrative services firm results in anaesthesiology practices reporting breaches (430,000)
- Flambeau reports security breach after cyber attack (10,447)
- MODE Global reports cyber attack (11,347)
- Australian government contractor PNORS Technology Group says stolen data yet to be posted online (unknown)
- Lodi Unified School District reports breach involving its Aeries application (unknown)
- Cyber attack leads to internet shutdown at Albany schools (unknown)
- Cyber attack disrupts Mexico’s transportation system (unknown)
- Maple Leaf Foods suffers outage following weekend cyber attack (unknown)
- Champaign County Clerk reports multiple DDoS attacks during election season (unknown)
- Spain’s General Council of the Judiciary suffers cyber attack (550,000)
- Seville Urban Transport Company disrupted by criminal hackers (unknown)
- Orange telecom customers affected by security incident (unknown)
- Yale Medicine discloses breach of doctor’s prior patient records system (unknown)
- Malaysian Electoral Commission suffers security incident (800,000)
- Bahraini websites hacked hours before parliamentary election (unknown)
- Data of Hereford school’s pupils posted on dark web (1,000)
- Hungarian edtech firm eKRÉTA breached by cyber criminals (720,000)
- Whoosh confirms security breach after hackers sell user records (7.2 million)
- New York-Presbyterian Hospital discloses security incident (12,000)
- Albany, NY, schools report cyber attack (unknown)
- Iranian hackers breached federal agency using Log4Shell exploit (unknown)
- Tuloso-Midway Independent School District discloses data security incident (unknown)
- County of Tehama, California identifies and addresses data security incident (unknown)
- San Gorgonio Memorial Hospital back online after malware attack (unknown)
- Interdev platform for Canadian paramedic agencies taken offline (unknown)
- Texas’ Pearland ISD says hackers in recent computer breach may contact, harass parents (unknown)
- Personal data of Kannur University students leaked from official website (30,000)
- Australia’s Xavier College says stolen student data might be released after hack (100)
- The Smith Family says donors’ personal details may have been exposed in hacking attack (80,000)
- South Walton Fire District notifies patients of security breach (unknown)
- Spain’s Generali España insurance company says it was hacked (unknown)
- Guadeloupe shuts down computer networks after major cyber attack (unknown)
- Connexin Software notifies parents of paediatric patients of hack (2,216,365)
- DDSB recovering from cyber attack that left schools without access to email or emergency contact information (unknown)
- Crown Point Community School Corp. students to return to school after network outage (unknown)
- Mercyhurst University announces security breach (unknown)
- GATE Petroleum Company announces cyber attack (unknown)
- TransUnion LLC confirms recent security incident (unknown)
- Health Care Management Solutions reports security breach (500,000)
- Metropolitan Associates reports leaked social security numbers (unknown)
- Morrison Products discloses security breach that leaked victims’ social security numbers (unknown)
- Massachusetts-based Eagle Bank reports recent security incident (unknown)
- AAA Collections files notice of security breach after unauthorised party accessed the company’s computer system (unknown)
Ransomware
- Vodafone Italy discloses data breach after security breach (295,000)
- Ransomware attack on Osaka General’s network stalls critical surgeries (unknown)
- Landi Renzo S.p.A. victim of cyberattack by Hive (unknown)
- Malaysian online stock brokerage UOB KayHian firm victim of ransomware (unknown)
- Macrotel, an IT solutions firm in Argentina, hit by ransomware (16,428)
- Norman Public Schools experiencing malicious ransomware attack (unknown)
- Convergent Outsourcing reports ransomware attack (unknown)
- Arkansas county offices working without computers during suspected ransomware attack (unknown)
- New York’s Commack School District faces ransomware attack (unknown)
- Canadian supermarket chain giant Sobeys suffered a ransomware attack (unknown)
- Salud Family Health reveals that it was breached in September (400,000)
- Ransomware attack responsible for shutdown affecting Michigan schools (unknown)
- Dallas Central Appraisal District Systems still down a week after ransomware attack (unknown)
- Vanuatu island hit by ransom attack, cripples government (unknown)
- AirAsia victim of ransomware attack, passenger and employee data acquired (5 million)
- Michigan prosthetics and orthotics provider discloses ransomware attack (877,584)
- DOCS Medical Group discloses ransomware incident (unknown)
- Puerto Rico’s Doctors Center Hospital reports patients affected by ransomware attack (1.2 million)
- Personal data leaked in hack of Radio Free Asia (3,779)
- Ransomware suspected as All India Institute of Medical Sciencesservers go down (unknown)
- Ontario Secondary School Teachers’ Federation victim of ransomware attack (unknown)
- Hacker breaks into Zwijndrecht police server (unknown)
- Southampton County, Virginia reports ransomware incident (unknown)
- One Brooklyn Health System offline for more than one week — has it been hit with ransomware? (unknown)
- Klinikum Lippe hospital decrypts data after “intensive negotiations” with ransomware attackers (unknown)
- Wright & Filippis files notice of data breach after being targeted by ransomware (877,000)
- Receivables Performance Management reports data breach following March ransomware attack (3.7 million)
Data breach
- Mediko learns that database of incarcerated people was leaking publicly onto the Internet (unknown)
- AstraZeneca password lapse exposed patient data (unknown)
- Brookfield admits ‘blackout pen’ error led to sharing of special education students’ information (unknown)
- Dutch Land Registry suffers data leak, with protected addresses accessible for nearly a month (unknown)
- El Paso High School students’ SAT scores were compromised after they flew out of a UPS truck (unknown)
- Suffolk police publish sensitive info of sexual assault victims online in data protection failure (unknown)
- South Reading & Shinfield Group Medical Practice clinic leaked the email addresses of patients in an emailed invitation (288)
- Community Health Network notifies patients of meta pixel breach (1.5 million)
- Medical software provider Tridas Center breached children’s personal data (16,000)
- Bahmni data breach exposes medical data (197,497)
- Millions of Twitter users’ stolen data leaked online (5.4 million)
- ICE accidentally released the identities of immigrants who sought protection in the U.S. (6,252)
Malicious insiders
- Ottawa police investigating allegations of officers leaking info to Freedom Convoy (unknown)
- Medical assistant charged with stealing and misusing patient identity information (27)
- Booz Allen Hamilton Holding Corporation notifies employees of insider breach (unknown)
- Meta fires employees for improperly accessing users’ accounts and selling data (unknown)
- Riverside Health Care reports privacy breach was due to inappropriate access of EMR by a staff member (unknown)
- Nurse removed confidential patient files from three nursing homes in Cork and Kerry (unknown)
Reference: https://www.itgovernance.co.uk/blog/list-of-data-breaches-and-cyber-attacks-november-2022
