5 Real-Life Data Breach Stories That Will Haunt Your Dreams

“It is, I confess, with considerable diffidence, that I approach the strange narrative which I am about to relate. The events which I purpose detailing are of so extraordinary a character that I am quite prepared to meet with an unusual amount of incredulity and scorn. I accept all such beforehand.” — Fitz-James O’Brien, What Was It?

This article is only for the bravest of SMB owners…..Read on if you dare…

Snowflake: The Credentials That Came Back From the Dead

In 2024, attackers targeted customer accounts on cloud data platform Snowflake using credentials that had previously been stolen by infostealer malware. According to Mandiant, some of those credentials dated as far back as 2020 and were still valid years later. The affected accounts generally did not have multifactor authentication enabled, allowing attackers to access customer environments, steal large amounts of data, and in some cases attempt to extort the victims.

Mandiant and Snowflake notified approximately 165 potentially exposed organizations during the investigation.

The frightening part? This wasn’t some newly discovered vulnerability in Snowflake’s platform. Mandiant reported that the incidents it investigated traced back to compromised customer credentials.

Some passwords, it seems, really can come back from the dead.

Volkswagen: Is It Possible to Steal a Deceased Person’s Identity?

Apparently so.

In March 2021, Audi and Volkswagen learned that an attacker may have obtained the personal data of more than three million individuals in the U.S. and Canada. A marketing services company under Volkswagen’s employ left personal information from potential customers unprotected for 21 months before the leak was discovered.

The exposure included driver’s license numbers and, in some cases, birth dates, Social Security numbers, account or loan numbers, and tax IDs from victims both living and dead.

Apparently, identity theft doesn’t necessarily end with the victim.

BayCare: The Call Came From Inside the House

Sometimes the threat isn’t trying to break into the building.

In 2025, the U.S. Department of Health and Human Services announced a settlement with Florida-based BayCare Health System following an investigation involving a malicious insider. According to HHS, a complaint alleged that an individual gained unauthorized access to a patient’s electronic protected health information.

The case is an uncomfortable reminder that cybersecurity isn’t only about keeping outsiders out. Organizations also need to control who can access sensitive information on the inside—and make sure that access is appropriate.

A ghoulish thought indeed.

PowerSchool: Something Followed the Kids Home

In December 2024, education technology company PowerSchool discovered suspicious activity involving compromised support credentials in its Student Information System.

According to an investigation conducted by CrowdStrike, the attacker used those credentials to access PowerSchool’s environment. PowerSchool subsequently deactivated the compromised credential, required password resets for employees and contractors, and tightened access controls.

The incident involved personal information belonging to current and former students and educators at schools using PowerSchool’s software.

For organizations relying on outside technology providers, it’s a frightening reminder: your cybersecurity risk doesn’t necessarily stop at your own network.

Sometimes the monster gets in through someone else’s door.

Change Healthcare: The Monster in the Supply Chain

In February 2024, Change Healthcare was hit by a ransomware attack that disrupted healthcare and billing systems across the country.

The scale was enormous.

The U.S. Department of Health and Human Services described the cyberattack as having an unprecedented impact on healthcare providers and patients. By July 2025, Change Healthcare had reported that approximately 192.7 million individuals had been impacted.

The incident demonstrated how an attack against one major technology provider can spread far beyond that organization, affecting healthcare providers, business partners, and patients throughout an interconnected ecosystem.

For businesses that depend on outside vendors to operate, that may be the scariest story of all.

“I can assure you,” said I, “that it will take a very tangible ghost to frighten me.” H.G. Wells, The Red Room

Don’t Become Next Year’s Campfire Story

Take heart, dear reader. The stories above are frightening, but they also offer an important lesson: cybersecurity incidents often begin with risks that could have been identified and addressed before they became headlines.

Cybersecurity Awareness Month is a good time to take a closer look at your own organization. Old credentials, unnecessary access, third-party vendors, ransomware, and overlooked cybersecurity risks may not be as entertaining as ghosts and monsters, but the consequences are considerably more real.

Learn how uRISQ can help your business better understand its privacy and cybersecurity risks and take practical steps to address them.

Because next October, you want to be the one telling scary stories around the campfire

not the one everyone is telling a story about.