Case studies — Documented breaches
Historic breaches
Twelve breaches that changed how security is done, rebuilt from public sources: what happened, how, with what impact and which lesson remains for defenders. They complement the advisories and vulnerabilities map (the current picture) and the malware catalogue (families and indicators).
Module overview
- Who it is for
- Students, developers, system administrators and analysts who want to understand why defences fail in real cases.
- Level
- Beginner–intermediate
- Duration
- About 45 minutes
- Prerequisites
- Basic concepts of networks, web applications and authentication.
Learning objectives
- recognise the recurring causes of breaches: missing patches, third-party credentials, cloud misconfigurations, phishing;
- link each case to the defensive measures that would have prevented or limited it;
- tell established facts (court documents, official reports) apart from figures claimed by attackers or the press.
The cases are described to learn how to defend, not to replicate them: read Ethics and law. Figures and attributions follow the public sources cited in each card; where they are uncertain, the text stays general.
Geography
Breach map
Click a marker on the map or a card below to link the location to the case details.
Analysis
The cases, one by one
Comparison
Comparison table
| Breach / victim | Year | Responsible | Scale | Key lesson |
|---|
Lessons from history
Breaches show where access management, event logging and data governance fail, often before any malware comes into play.
- From SQL injection on a forgotten website to espionage campaigns against government agencies
- From publishing data for extortion to the silent exfiltration of billions of accounts
- From compromised payment terminals to cloud misconfigurations