Worst Data Breaches of 2018

It seemed like data breaches were everywhere in 2018, affecting everyone from Walmart to Chili's to the U.S. Postal Service. Here are a few of the biggest data breaches of the year.

It seemed like data breaches were everywhere in 2018, affecting everyone from a Canadian cannabis store to Chili’s restaurants. Yale even discovered and disclosed a 2008 data breach this year. The amount and types of data accessed varied, but each incident was another reminder of the importance of data security.

We've rounded up a few of the biggest data breaches from 2018 below.


One of the biggest data breaches of the year—and potentially of all time—was disclosed earlier this month. Marriott International, the world's largest hotel chain, announced a breach of its Starwood guest reservation database and said that as many as 500 million guests could be affected. Upon investigation, Marriott found that there had been unauthorized access since 2014 and that an "unauthorized party" had copied and encrypted some information and "took steps toward removing it," but the company did not specify how much data was removed.

Marriott said that for about 327 million of affected guests, accessed information included some combination of a name, address, phone number, email, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation data, and communication preferences.

My Fitness Pal

Under Armor said about 150 million users were affected by a data leak in the company's MyFitnessPal app that occurred in February. Under Armor said it notified users via email and in-app messages, and it was "working with leading data security firms to assist in its investigation."

The company said "an unauthorized party acquired data associated with MyFitnessPal user accounts," such as user names, passwords, and email addresses.


About 100 million Quora users were affected by authorized access to one of its systems by a "malicious third party," according to the site. Quora said it was logging out all users who might have been affected in order to prevent further damage and notifying users whose data had been compromised.

Compromised information may include names, emails, encrypted password and data imported from linked networks.


A security vulnerability in the U.S. Postal Service's "Informed Visibility" mail tracking and reporting service potentially exposed the data of more than 60 million customers. The postal service said it was not aware of anyone's records being accessed, but the security hole has been fixed.

The service's API could have allowed almost anyone with a USPS account to view other users' account details and even access information such as when critical documents and checks were scheduled to be delivered to their mailboxes.


Among the many unfortunate headlines for Facebook this year was a massive data breach that exposed the account details and personal information of almost 50 million users. Facebook said it had fixed the security vulnerability and alerted authorities about the breach.

The hack was possible due to Facebook's "View As" feature, which lets users view their own account as if they were a stranger in order to check post privacy settings, etc. The feature gives the user an "access token" that allows them to log back into their account without resubmitting information, and hackers exploited this to harvest other users' access tokens.

If you use the same login information and password for accounts across many different websites, hackers could potentially find your login in a data breach of a lower-stakes app and use it to access your account on something more important and private, like a bank account. Read more about protecting yourself from hackers here.

If you've been hacked, here are some steps you can take to protect yourself after the fact.

Download Center

HTML - No Current Item Deck
  • COVID-19 Return to Work Kit

    Streamline your return to work program and ensure your employees can get back safely with these resources created by certified occupational health, safety, and infectious disease experts.

  • 9 Common Questions About Behavior-Based Safety

    Renowned workplace safety expert Dr. Andrew Sharman answers 9 of the most pressing questions EHS professionals have about behavior-based safety programs.

  • COVID-19 Employee Health Screening Toolkit

    Powerful health assessment tools designed to help occupational health practitioners, employee health departments, and health and safety professionals conduct rapid workforce health screening to reduce the risk of infection and ensure business continuity.

  • RSIGuard Home Ergonomics Software

    Ensure you and your employees can work safely from home with a 6 month free trial of the RSIGuard desktop ergonomics software.

  • 5 Reasons You Should Embrace the Cloud for EHSQ Software

    EHSQ managers can realize reduced costs, increased productivity and enhanced software reliability when using SaaS.

  • Industry Safe

OH&S Digital Edition

  • OHS Magazine Digital Edition - June 2020

    June 2020


      Recognizing and Mitigating Static Electricity Hazards
    • OIL & GAS
      New Gas Detection Technology
      Stop Sweating Heat Stress
      Electricity is Everywhere
    View This Issue