Data is the lifeblood of every company operating in the modern business world. Without ready, secure and consistent data access, most companies will simply cease to function altogether, which is why data recovery services are on hand to avoid this eventuality.
Outside of the reputational harm and potential legal penalties that come through inadequately secured personal data, data loss can cause significant disruption to people attempting to work through the system, a loss of access entirely, direct financial damage and risk of legal challenges.
Data breaches can typically be devastating for any company that handles significant volumes of data, which is why cottage industries have emerged that steal, encrypt and hold data hostage, typically for a monetary ransom, one that companies will typically pay.
The reason why they are so concerned about data losses can be found in the third (or second, depending on how it is measured) largest data breach ever recorded, one that was so devastating that it immediately destroyed the company involved.
Verifications.io
The single biggest data breach ever recorded was the entire email database of one of the biggest dotcom companies ever in Yahoo, with 3bn user accounts breached in what the company claimed was a state-sponsored attack.
The second biggest was the Aadhaar database, a biometric ID system established by the Indian government, which had been leaked or been made inadvertently publically accessible in a range of different places before it was removed by the Unique Identification Authority of India.
The third biggest (potentially the second biggest due to a discrepancy in how the leak is measured) is a relatively much smaller email marketing and technology services company that by virtue of its primary service had access to potentially billions of records, potentially affecting a third of the global population.
The company was Verifications.io, which served as a validation service for email marketers, providing a service based on a relatively simple principle.
Companies would submit lists of client records, primarily email addresses, phone numbers and some lead information for business contacts, and Verifications.io would send test emails to check if they were active users who read their correspondence, rather than bounced inactive or otherwise unusable data.
Bounced email addresses would be later stored to make the submissions more efficient and expedient, but the problem was how it was stored, and this act of sheer irresponsibility would destroy the company and put hundreds of millions of people at risk of cybersecurity attacks.
The data was stored in unsecured MongoDB files that anyone could access if they knew the correct URL.
The exposed data was first brought to light on 25th February by Bob Diachenko, a cybersecurity researcher, who worked with Vinny Troya, another researcher, to examine the nature of the data.
This was when it was found that the leaked information was not client data but personal data belonging to members of the public, and after working with Troy Hunt of the data breach website Have I Been Pwned, they started to piece together what was new in the data.
Mr Diachenko traced it to Verifications.io and contacted the company, which responded by taking “appropriate measures” and closing down entirely, first shutting down the website on 4th March 2019, before closing entirely 11 days later.
