The biggest attacks

The cyberattacks with the largest confirmed impact: at least 500 million US dollars lost, data of 100 million people, or national outages.

Attacks: 22
Loss of USD 500 million or more: 6
Data of 100 million or more: 10
National outages: 8

2026Crypto theft Loss met

Binance hack

stolen, according to Binance: USD 6.3 billion
blockchains on which its hot wallets were drained (Elliptic): 11

The figures are still changing.

Binance says the intruders got in partly through a compromised staff laptop and drained its hot wallets within about four hours. Binance is covering the loss from company funds, and the FBI blames North Korea.

Victim: Binance, the largest cryptocurrency exchange
Attributed to: North Korea (TraderTraitor), according to the FBI

What helps against attacks like this

Keep on an exchange only what you trade. Keep savings in a wallet whose keys you hold, such as a hardware wallet.
Turn on a withdrawal allow-list and sign in with a security key or an authenticator app.

2025Crypto theft Loss met

Bybit hack

in virtual assets stolen (FBI): USD 1.5 billion
ether and staked-ether tokens taken (Bybit): ~401,000

During a routine transfer from Bybit's ether cold wallet, the signers saw a manipulated interface and approved a transaction that handed the wallet to the attackers. It was the largest crypto theft on record until the Binance hack.

Victim: Bybit, a cryptocurrency exchange in Dubai
Attributed to: North Korea (TraderTraitor), according to the FBI

What helps against attacks like this

Keep long-term holdings in a wallet you control, and use a withdrawal allow-list on exchanges.
Organizations: check every transaction on a separate, trusted device before signing it.

2024Data theft and extortion Data met

Snowflake customer breaches

customer organizations broken into (US Department of Justice): 165+
people affected at those customers (US Department of Justice): 100 million+

Criminals logged into customers' Snowflake accounts with passwords stolen by infostealer malware. The accounts had no multi-factor sign-in, and the criminals copied the data and demanded ransom.

Victim: Customers of the Snowflake cloud data platform, including AT&T, Ticketmaster and Santander
Attributed to: Criminal hackers charged by the US Department of Justice; one pleaded guilty in August 2026

What helps against attacks like this

Keep malware protection up to date: infostealers take the passwords saved on a device. Antivirus
Be wary of messages that quote your call or purchase history.
Organizations: require multi-factor sign-in on every cloud account and replace old passwords.

2024Ransomware Loss met Data met Outage met

Change Healthcare ransomware attack

people whose data was stolen (Change Healthcare): 192.7 million
costs in 2024 for the response and the disruption (UnitedHealth): USD 3.1 billion

Ransomware shut down Change Healthcare in February 2024. Pharmacies and clinics across the US could not bill or check insurance for weeks, and the data of about 193 million people was stolen.

Victim: Change Healthcare (UnitedHealth Group), which processes a large share of US medical claims and pharmacy payments
Attributed to: ALPHV/BlackCat ransomware, according to UnitedHealth

What helps against attacks like this

Organizations: require multi-factor sign-in on every remote-access portal.
Keep offline backups and test restoring core systems. Privacy and backup
Clinics and pharmacies: keep a second way to file claims and take payments.

2023Sabotage Outage met

Kyivstar cyberattack

mobile subscribers without service (Kyivstar): 24 million
until all services were back (VEON): 1 week

A destructive attack on December 12, 2023, took Ukraine's largest mobile network offline. About 24 million subscribers lost phone and internet service, and some air-raid alerts and card terminals failed too.

Victim: Kyivstar, Ukraine's largest mobile operator
Attributed to: Russian military intelligence (GRU unit 74455, Sandworm), according to Ukraine's SBU

What helps against attacks like this

Keep a second SIM or eSIM from another operator for emergencies.
Organizations: keep administrator accounts under strict control.
Keep offline backups and a rehearsed plan to rebuild systems. Privacy and backup

2023Network intrusion Outage met

DP World Australia cyberattack

without trucks collecting or delivering containers at four ports (DP World): 3 days
containers backed up (DP World): 30,000+

Intruders in DP World Australia's network forced the company to cut its four container terminals off the internet in November 2023. The government called it a nationally significant incident.

Victim: DP World Australia, which runs container terminals in Sydney, Melbourne, Brisbane and Fremantle
Attributed to: Not attributed

What helps against attacks like this

Organizations: keep manual procedures ready for when systems fail.
Separate networks, so that one intrusion cannot reach everything.
Keep offline backups. Privacy and backup

2022Ransomware Outage met

Costa Rica government ransomware attacks

ransomware groups: Conti against the government, Hive against the social security fund: 2
of 1,500 servers of the social security fund encrypted (CCSS): ~30

Conti ransomware hit Costa Rica's finance ministry and other agencies in April 2022, and the new government declared a national emergency. A second attack on May 31 sent the hospitals and clinics of the social security fund back to paper for weeks.

Victim: Costa Rica's government, starting with the finance ministry, and the social security fund CCSS
Attributed to: Conti and Hive ransomware, according to the government and the CCSS

What helps against attacks like this

Organizations: require multi-factor sign-in for all remote access.
Keep offline backups and test restoring them. Privacy and backup
Clinics: keep paper procedures ready for downtime.

2022Crypto theft Loss met

Ronin bridge hack

stolen (FBI): USD 620 million
until anyone noticed (Ronin): 6 days

Attackers took control of five of the nine validator keys that secure the Ronin bridge and withdrew 173,600 ether and 25.5 million USDC. Nobody noticed for six days, until a user could not withdraw.

Victim: Ronin Network, the bridge of the game Axie Infinity (Sky Mavis)
Attributed to: North Korea's Lazarus Group and APT38, according to the FBI

What helps against attacks like this

Treat unexpected job offers and files from recruiters as a possible attack.
Organizations: spread signing keys across independent parties and alert on large withdrawals at once.

2021Sabotage Outage met

Iran fuel station cyberattack

sales of subsidized fuel by smart card disrupted (Iranian officials): nationwide

A cyberattack on October 26, 2021, shut down the smart-card system Iranians use to buy subsidized fuel, and long queues formed at filling stations across the country. Officials confirmed the attack, and many stations were still closed the next day.

Victim: Iran's smart-card system for subsidized fuel and the filling stations that use it
Attributed to: Iranian officials blamed an unnamed foreign country

What helps against attacks like this

Organizations: keep a way to sell and take payment when the central system is down.
Keep central management systems under strict control.
Keep offline backups and rehearse recovery. Privacy and backup

2021Ransomware Outage met

Transnet port terminals cyberattack

container terminals under force majeure: Durban, Ngqura, Gqeberha, Cape Town (Transnet): 4
until force majeure was lifted on August 2 (Transnet): 11 days

A cyberattack in July 2021 disabled the system that runs South Africa's main container terminals, and staff fell back on manual work. Transnet declared force majeure until the system was restored.

Victim: Transnet, South Africa's state port and rail operator
Attributed to: Not attributed

What helps against attacks like this

Organizations: keep manual procedures ready for when systems fail.
Keep offline backups and test restoring them. Privacy and backup
Separate networks, so that one intrusion cannot reach everything.

2021Ransomware Outage met

HSE ransomware attack (Ireland)

until all servers were decrypted (Comptroller and Auditor General): 130 days
IT devices at about 4,000 locations (Comptroller and Auditor General): 70,000+

Conti ransomware hit Ireland's national health service on May 14, 2021, and the HSE switched off its entire IT network. Hospitals worked on paper, and radiotherapy and other services stopped.

Victim: Health Service Executive (HSE), Ireland's public health service
Attributed to: Conti ransomware, named by the HSE

What helps against attacks like this

Organizations: watch for attacks around the clock and act on alerts.
Keep offline backups and tested restore plans. Privacy and backup
Separate the networks of connected organizations.

2021Ransomware Outage met

Colonial Pipeline ransomware attack

that the main fuel pipeline to the US East Coast was shut (Colonial Pipeline): 5 days
ransom paid; the FBI seized 63.7 BTC back (US Department of Justice): 75 BTC

Ransomware in Colonial Pipeline's office IT led the company to shut down the main fuel pipeline to the US East Coast in May 2021. Panic buying left many filling stations dry.

Victim: Colonial Pipeline, the largest fuel pipeline in the US
Attributed to: DarkSide ransomware, according to the FBI

What helps against attacks like this

Organizations: separate office IT from the systems that run operations.
Require multi-factor sign-in on every remote-access account.
Keep offline backups and a rehearsed plan for manual operation. Privacy and backup

2021Scraping Data met

Facebook phone number scrape

Facebook users in 106 countries (German Federal Court of Justice): 533 million
fine from the Irish Data Protection Commission: EUR 265 million

Before September 2019, attackers abused Facebook's contact import to match phone numbers to profiles. The data set was published free online in April 2021.

Victim: Meta (Facebook) and its users
Attributed to: Not attributed

What helps against attacks like this

Hide your phone number and email address from profile search.
Treat unexpected calls and texts that use your name as possible phishing.
Use two-factor sign-in with an app, not by text message.

2019Data theft Data met

Capital One data breach

people in the US and Canada (Capital One): 106 million
penalty from the US bank regulator OCC: USD 80 million

An intruder used a misconfigured cloud setup to download data on about 100 million people in the US and 6 million in Canada, mostly from credit card applications. The US bank regulator fined Capital One 80 million dollars for weak risk controls in its move to the cloud.

Victim: Capital One, a US bank
Attributed to: A former tech worker in Seattle, acting alone; convicted by a US jury in 2022

What helps against attacks like this

Freeze your credit if your Social Security or Social Insurance Number was exposed.
Organizations: review cloud storage permissions and access roles regularly.

2018Data theft Data met

Marriott (Starwood) guest database breach

guest records at most (Marriott): 383 million
unencrypted passport numbers (Marriott): 5.25 million

Attackers were inside the reservation database of the Starwood hotel group from 2014 until 2018. Marriott bought Starwood in 2016 and found the intrusion only in 2018.

Victim: Marriott International, through the guest database of the Starwood hotels
Attributed to: Not attributed

What helps against attacks like this

Use a different password for every loyalty program. Password managers
Be wary of emails that quote your bookings or loyalty number.
Organizations: check the IT of companies you take over for intrusions.

2018Data theft Data met

MyFitnessPal data breach

user accounts (Under Armour): 150 million

An unauthorized party took usernames, email addresses and hashed passwords of MyFitnessPal users. Payment card data was stored separately and was not affected.

Victim: Under Armour, maker of the MyFitnessPal app
Attributed to: Not attributed

What helps against attacks like this

Use a password manager and a different password for every service. Password managers
Turn on two-factor sign-in where the app offers it.

2018Crypto theft Loss met

Coincheck NEM theft

in customers' NEM coins stolen (Japan's Financial Services Agency), about USD 530 million at the time: JPY 58 billion
NEM coins moved out (Coincheck): 523 million

Attackers obtained the private keys of the online wallet that held all of Coincheck's customer NEM coins and moved the coins out within about eight hours. Japan's regulator ordered the exchange to improve its controls.

Victim: Coincheck, a cryptocurrency exchange in Tokyo, and its customers
Attributed to: Not attributed

What helps against attacks like this

Keep larger crypto amounts in a hardware wallet you control, not on an exchange.
Exchanges: keep most customer coins in offline (cold) storage.

2017Data theft Data met

Equifax data breach

people whose names and birth dates were taken (FTC): 147 million
settlement at most, with the FTC, the CFPB and US states: USD 700 million

Attackers got in through an unpatched web application and took names, birth dates and Social Security numbers of about 147 million people. Equifax agreed to pay up to 700 million dollars.

Victim: Equifax, a US credit reporting agency
Attributed to: Four members of China's People's Liberation Army, charged by the US Department of Justice in 2020

What helps against attacks like this

In the US: freeze your credit with the credit bureaus.
Check your credit reports for accounts you did not open.
Organizations: patch systems that face the internet quickly.

2016Data theft Data met

Yahoo data theft of 2013

user accounts: every account that existed in August 2013 (Yahoo): 3 billion

Attackers copied data of every Yahoo user account that existed in August 2013. Yahoo disclosed the theft in December 2016 and said only in October 2017 that all accounts were affected.

Victim: Yahoo
Attributed to: Not attributed

What helps against attacks like this

Use a password manager and a different password for every service. Password managers
Turn on two-factor sign-in, above all for your main email account.
Give security questions answers nobody can look up.

2016Data theft Data met

Yahoo data theft of 2014

user accounts at least (Yahoo): 500 million
SEC penalty for telling investors two years late: USD 35 million

Account data of at least 500 million Yahoo users was stolen in late 2014, including names, email addresses, birth dates and hashed passwords. Yahoo told the public only in September 2016.

Victim: Yahoo
Attributed to: Two officers of Russia's FSB intelligence service and two hackers working with them, charged by the US Department of Justice in 2017

What helps against attacks like this

Use a password manager and a different password for every service. Password managers
Turn on two-factor sign-in for email accounts.

2015Bank theft Loss met

Carbanak and Cobalt bank thefts

losses of the financial industry in total (Europol): EUR 1 billion+
banks and other financial institutions in 40 countries (Europol): 100+

A criminal group sent spear-phishing emails to bank staff and took over internal systems. It stole money through fraudulent transfers and through ATMs that paid out on command.

Victim: More than 100 banks and other financial institutions in about 40 countries
Happened: 2013 to 2018
Attributed to: A criminal group; Europol said its suspected leader was arrested in Spain in March 2018

What helps against attacks like this

Banks: give staff phishing-resistant sign-in and keep administrator rights tight.
Keep payment and ATM systems apart from office networks, and alert on unusual transfers.

2009Data theft Data met

Heartland Payment Systems breach

card numbers stolen from Heartland and four other companies (US Department of Justice): 130 million+
costs Heartland booked for 2009 (annual report): USD 128.9 million

Attackers broke in through a SQL injection flaw and planted malware that read card data as it passed through Heartland's systems. Prosecutors called it the largest hacking and identity theft case they had ever brought.

Victim: Heartland Payment Systems, a US card payment processor
Happened: Late 2007 to 2008
Attributed to: A US hacker and two accomplices in or near Russia, charged by the US Department of Justice; the US hacker was sentenced to 20 years

What helps against attacks like this

Turn on card alerts and check your statements.
Payment firms: encrypt card data end to end and watch servers for unknown software.

How an attack gets on this list

Thousands of attacks become public every year. This list keeps only those with the largest impact. An attack is listed if it meets at least one of three criteria. The figure must come from the victim, an authority, a regulator or a court, not only from the press or the attackers.

Criterion	Met when
Loss	at least 500 million US dollars were stolen or lost, at the value at the time; the victim’s own costs count
Data	data of at least 100 million people, user accounts or payment cards was taken or published
Outage	critical services such as health care, energy, transport, telecom or payments failed at national level for at least a day

Attacks that spread through a known vulnerability, such as WannaCry and NotPetya, are on the list of vulnerabilities. Attacks on industrial control systems have their own cards.

The measures on each card help against attacks of that kind. They are not a claim that they would have stopped that attack.

Known, but not on the list

Name	Year	Why not
Jaguar Land Rover	2025	Car production stopped for about five weeks. Making cars is not a critical service, and the costs booked so far, 196 million pounds, are below the threshold.
Ascension	2024	Hospitals worked on paper for weeks, but in one hospital group, not a national service. Data of 5.6 million people was taken.
Poly Network	2021	About 610 million US dollars in tokens were taken, but the attacker returned them within two weeks.
SolarWinds	2020	Espionage through a tampered update that fewer than 18,000 customers installed. No confirmed loss, data count or outage reaches the thresholds.
Mt. Gox	2014	About 850,000 bitcoin went missing, and 200,000 of them were found again. At the time, the rest was worth less than 500 million US dollars.
Target	2013	About 40 million payment cards and the contact details of up to 70 million people: below 100 million.