Here’s a look at the biggest data breaches of 2024 and how you can protect yourself

Aug 18, 2024, 5:00 AM

An Optus public service message is displayed inside an Optus store in Sydney, Australia. 2024 has b...

2024 has been a banner year for data breaches. (Photo by Brendon Thorne/Getty Images)

(Photo by Brendon Thorne/Getty Images)

KTAR.com

From big banks to car dealerships, 2024 has been a banner year for data breaches. Yes, I mean that in the worst way possible. I’d be shocked if there’s any American left unexposed at this point. Here are some companies that may have exposed your data.

New! For the first time ever, the award-winning Kim Komando Show is available as a podcast. Find it now in your favorite podcast player.

National Public Data breach: 2.9 billion people exposed

Hard to imagine much worse than a background-check company being hacked. Their entire job is to dig up and collect non-public data. A lawsuit claims it was National Public Data’s negligence that exposed 2.9 billion people. Details include Social Security numbers, full names and addresses. Hacking group ASDoD put the database of the stolen information up for sale for $3.5 million. No word yet on any ransom payment.

Through a process called scraping, NPD collects and stores personal data from “non-public sources” to perform background checks. In other words, the company gathers information that wasn’t willingly (or knowingly) handed over.

Depending on what happens in court, NPD could be required to purge personal data of impacted individuals and to encrypt all collected data going forward.

Ascension ransomware attack: Up to 140 hospitals

In May, an employee at one of the country’s biggest health care systems accidentally downloaded malware. What happened next was a cyberattack avalanche.

Ascension runs 140 hospitals in 19 states and Washington, D.C. On May 8, they detected unusual activity within their network. The disruption quickly became so bad that Ascension had to shut down emergency rooms and reroute patients.

Hackers got their hands on 7 of Ascension’s 25,000 servers; who was impacted is still under investigation. Ascension recently said around 500 individuals were affected, but I’m willing to bet the final number will be a lot higher.

CDK global attack: 15,000 car dealerships

One of the biggest car dealership software companies got hit with a double whammy in June. CDK, used by 15,000 dealerships for payroll and finance tasks, shut down its systems after back to back cyberattacks on the 18th and 19th. Rumor has it the ransom payment was worth tens of millions of dollars.

The shutdown majorly disrupted dealership operations and sales. One Lexus dealership in New Jersey reported new car sales down 50% in June.

Change Healthcare attacks

Change Healthcare, a tech firm owned by UnitedHealth, is used by thousands of pharmacies, hospitals and health care facilities to receive payments and process claims.

One attack discovered in late February caused massive disruptions for weeks throughout the U.S. health care system. UnitedHealth paid a whopping $22 million ransom to Russian cybercriminal group BlackCat to stop them from sharing the data they stole.

Then another gang of crooks, RansomHub, claimed they stole data, too. In April, UnitedHealth said a “substantial proportion” of Americans’ data was exposed. Estimates say as much as a third of all Americans were impacted. That includes sensitive medical data, including test results, diagnoses and images.

AT&T breach: 73 million customers

In March, AT&T disclosed that hackers stole data from “nearly all” current and former customers. The data goes back as far as 2019 and includes some really personal information, including Social Security numbers. They reportedly paid hackers a $370,000 ransom to delete the information.

Honorable mention

Advance Auto Parts (July): Personal information of over 2.3 million individuals was stolen.
Roku (April): Through “credential stuffing” aka using logins leaked in other breaches, hackers accessed around 591,000 accounts. No financial info was accessed.
Truist Bank (June): Hacking group Sp1d3r stole information about 65,000 employees and posted it for sale online.
Tile (June): Life360, the company behind Tile tracker devices, reported a breach that included names, addresses, email addresses, phone numbers and device identification numbers.
Ticketmaster (June): This one impacted 560 million customers; data included names, addresses, phone numbers, email addresses, order history and partial payment info.
Dropbox (May): Attackers accessed Dropbox Sign’s development environment, compromising customer information.
TeamViewer (July): Employee directory data, including names and encrypted passwords, was exposed.

Locked down

You can’t stop a hacker from breaching a major company, but you can protect yourself from the fallout.

Double-check all health care communications. If you receive an explanation of benefits (EOB) or a bill for services you didn’t receive, contact your health care provider and insurance company ASAP. It likely means someone is using your benefits for their own health care.

Treat email requests with caution. Be skeptical of anything that seems super urgent. It’s OK to slow down for safety. My rule of thumb: If it’s a strange written request, like a text or email, I make a phone call.

Be wary of “old friends” who appear out of nowhere. It could be a hacker who happens to have a little (stolen) info. Take time to confirm they are who they say they are.

Make a list of exposed data. Keep this digitally or just on a Post-it. Be suspicious of anyone who references it in an email or phone call. Say the company you financed your car through was hacked. Alarm bells should raise if you get a call out of the blue that there’s a major issue with your loan.

Update your PIN and banking login credentials. Even if they weren’t involved directly in the breach, hackers can use your personal info to access it. Keep an eye on your bank and credit card statements for anything out of the ordinary. Set up banking alerts on your phone while you’re at it.

Freeze your credit. This will keep scammers from opening a credit card or loan in your name. Like setting up a fraud alert, you’ll need to contact each of the three credit bureaus.