Largest data breaches of all time

35 Comments

• Jan Willem Tulp — June 13, 2011 at 1:52 am

  Great work, Nathan! Beautiful and insightful!
  • Nathan Yau — June 13, 2011 at 9:47 am

    Thanks, Jan :)
• Peter Hillier — June 13, 2011 at 4:34 am

  Great resource, but have I missed the legend for the color codes identifying the breach type?
  • Hal — June 13, 2011 at 6:04 am

    I am looking for the same key
    • nun — June 13, 2011 at 11:23 am

      Colors indicate the type of breach: fraud, lost, stolen, hacked
    • Icalasari — June 22, 2011 at 5:14 pm

      nun: Does green indicate fraud? Lost? Does blue indicate hacked? Does invisible with pink and purple polkadots mean stolen?
    • Icalasari — June 22, 2011 at 5:15 pm

      And now I fail for not noticing the blatant text above each grouping
• will ouyang — June 13, 2011 at 6:06 am

  neat graphics. Like Peter said…it hints at the color codes, but I’m curious what it means. Maybe if I buy the book I’ll find out! :)
• Oliver — June 13, 2011 at 6:43 am

  The color codes correspond to the type of loss. Green is “hacked”, blue is “lost” etc. No key is necessary but the color coding differences aren’t apparent at first glance.
  • will ouyang — June 13, 2011 at 7:36 am

    thanks! …I clearly missed that one.
    • Nathan Yau — June 13, 2011 at 9:24 am

      @Will – I guess I should’ve made it a little more clear. I just added a little bit more text so that it’s more obvious.
• Larry — June 13, 2011 at 7:15 am

  It would be nice if there were a hyperlink to at least one news article describing the breach available to get further information. This is one of the more trusted of the sources I’ve found for further data. http://www.privacyrights.org/data-breach
  • Nathan Yau — June 13, 2011 at 9:48 am

    @Larry – The previously mentioned DataLossDB also does a good job at keeping up-to-date information about data breaches. They keep record of new incidents and include links to new sources for more information.
• Joe — June 13, 2011 at 7:32 am

  So if one aggregates the recent April/May Sony breaches together, that puts them ‘securely’ in the #2 spot overall.
  I have been watching the news, but haven’t seen anything that shows what Sony’s doing to soothe customers.
• DED — June 13, 2011 at 9:30 am

  Nathan, I very much enjoy your work. But, I’m wondering if you have ever studied InfoVis outside of statistics? I can’t tell if you are aware that visualizing data is a defined discipline both academically and practically that people get degrees in? Have you looked at Stephen Few’s, E. Tufte, Ben Schniederman or A. Ware’s work. Some of the issues I see cropping up here, like making the color coding more obvious, are covered in their works. Just wondering.
  I ordered your book by the way, looking forward to reading it.
  • Nathan Yau — June 13, 2011 at 9:46 am

    @DED – Yep, I’ve studied the work of all those you mentioned. And I also like to experiment.

    Enjoy the book!
    • DED — June 14, 2011 at 7:58 am

      Yes, it is good to experiment. With the color coding in your graph, there is some work in educational psychology that addresses the issue of proximity when labeling graphical material. I noticed in your graph that the user has to make two mental steps to relate the color with the words : fraud, hack, and lost. The first is to find the word, and the second is to mentally connect the particular word with the color. I had trouble with it at first, mostly because the word in question didn’t stand out from the surrounding text. And then because I had to look at several elements before noticing the pattern.
      Maybe highlighting the important word in each element would help.
• John — June 13, 2011 at 12:14 pm

  The biggest incident that came to my mind is this one (affecting 25 million people — including the names, addresses and dates of birth of essentially every child in the UK):

  http://en.wikipedia.org/wiki/Loss_of_United_Kingdom_child_benefit_data_(2007)

  I wonder why that’s not in there?
• Mike N — June 13, 2011 at 12:32 pm

  Nathan,

  Did you do this in R? Is there any way to post the code or a link to it? Just curious to expand my R horizons. Thanks.

  Mike
  • Nathan Yau — June 13, 2011 at 12:50 pm

    @Mike N – I did this in Illustrator, but have done something similar to this in R using base graphics. I’ll try to put together a tutorial some time.
    • Mike N — June 13, 2011 at 2:08 pm

      Sure no worries or hurry. I’m just trying to get better at creating these kind of graphics using R so if it was easy/available… Thanks!

      MN
• FP — June 13, 2011 at 1:59 pm

  I’m confused by RockYou, Inc. and HM Revenue and Customs. The numbers and dates are the same, but the rankings and block sizes are different.
  • Nathan Yau — June 13, 2011 at 2:21 pm

    @FP – Good catch. Fixed.
• Matthew — June 13, 2011 at 2:04 pm

  How do you define a “record” though? I wonder if they may be counting certain backups as their own recod.
• Cartherine Roy — June 13, 2011 at 7:27 pm

  Please get to know @londesc ().
  • Catherine Roy — June 13, 2011 at 7:28 pm

    It would seem that your blog does not permit legitimate links. In any case, please look into the @longdesc attribute.
• Phil Agcaoili — June 14, 2011 at 1:26 am

  Nathan,

  This is good!

  You may want to add detail like Spear Phishing, RSA hack-related, Adobe Zero-Day, etc. because it helps gives context on trends to how companies were exploited.

  I’m also interested to see what the losses were like post-incident. How big were the fines? Court information?
  What happened to the bad guys? Jail? Slap on the wrist?

  Thanks for putting this together.

  Phil Agcaoili
• mary luceri — June 14, 2011 at 10:53 am

  I have been to one of Tufte’s workshops. It was very good. And the cost of the workshop includes all the books he’s published. Well worth it.
• InfoSight — June 14, 2011 at 12:55 pm

  Do you have back track link so I can post this on my blog?
• Username — June 23, 2011 at 6:24 pm

  try using http://attrition.org/security/rant/sony_aka_sownage.html for your timeline, there’s a few more events that you’re missing
• Rick — July 5, 2011 at 8:05 am

  I’d be tempted to color the words of “(hacked, stolen, lost, or fraud)” by the color used to represent them in the actual charts. That would make it easier to see what the colors represent, but is there a downside to doing that?

  I’m really looking forward to getting your book!
• Lisa Neidert — July 5, 2011 at 8:36 am

  It would be nice to include a link to a news story about each of these data breaches or some sort of citation information. Otherwise, very nice rendition.
• seanboon — September 27, 2011 at 9:06 am

  Do these chart types (the top one) have a name? I’ve been searching all over the place looking for a name for this type of chart and I can’t find one. If I were to name them, I’d call them “particle charts”.
  • seanboon — September 27, 2011 at 9:30 am

    Looks like they are called unit charts.

    http://www.perceptualedge.com/articles/visual_business_intelligence/unit_charts_are_for_kids.pdf

    -Sean
• Louis Galipeau — October 7, 2011 at 10:54 am

  What about Lockheed and Martin? Or not significant enough?