37 landmark incidents from 1988 to 2025, what went wrong, and the controls each one teaches
Exam scenarios are built on real events. Knowing why WannaCry spread, how SolarWinds reached its victims or what MFA would have changed at Colonial Pipeline makes questions about patching, segmentation, supply chain risk and identity much easier. Each entry gives a factual summary, the root cause as described by official or first-party sources, and the security lessons it teaches.
How these entries are sourced: Each entry summarises what official reports, court documents, regulators, the affected organisations and named security researchers have published. Figures come only from the cited public sources and are credited to them; where no reliable figure exists the impact is described in words. Attributions are those made publicly by governments, courts, victims or vendors, never CyberCertPrep's own. Check the linked sources for the full and current picture. Last reviewed 2026-10-25.
Showing 37 of 37 incidents
1988 - 2 November 1988
Computers connected to the early internet, largely at universities and research and military sites
The Morris worm was one of the first worms to spread across the internet.
Root cause and lessons2000 - 4 May 2000
Windows users and organisations worldwide
ILOVEYOU arrived as an email with the subject line "ILOVEYOU" and an attachment that looked like a text file but was a Visual Basic script.
Root cause and lessons2001 - 19 July 2001
Internet-facing Microsoft IIS web servers
Code Red exploited a buffer overflow in the indexing service of Microsoft's IIS web server, which Microsoft had patched a month earlier in bulletin MS01-033.
Root cause and lessons2003 - 25 January 2003
Systems running Microsoft SQL Server 2000 or MSDE 2000
SQL Slammer, also called Sapphire, was a tiny worm that fitted in a single UDP packet and exploited a buffer overflow in Microsoft SQL Server's resolution service, patched six months earlier in MS02-039.
Root cause and lessons2009 - Disclosed 12 January 2010
Google and, according to Google, at least twenty other large companies
In January 2010 Google disclosed that in mid-December 2009 it had detected a highly sophisticated, targeted attack on its corporate infrastructure that resulted in theft of intellectual property, and that a primary goal appeared to be accessing the Gmail accounts of Chinese human rights activists.
Root cause and lessons2010
Industrial control systems running Siemens Step 7 and S7 PLCs
Stuxnet became public in 2010 as the first widely known malware designed to sabotage physical processes.
Root cause and lessons2011 - Disclosed 17 March 2011
RSA, the security division of EMC
RSA disclosed in an open letter that it had been the target of an extremely sophisticated cyber attack and that information related to its SecurID two-factor authentication products had been extracted.
Root cause and lessons2013 - November to December 2013
Target Corporation and its customers
Attackers stole payment card data from Target's US stores during the 2013 holiday season by installing malware on point-of-sale systems.
Root cause and lessons2014 - 2014, disclosed 2016
Yahoo and its users
Attackers broke into Yahoo's network in 2014, stole data from user accounts and gained the ability to forge cookies to access accounts without passwords.
Root cause and lessons2014 - November 2014
Sony Pictures Entertainment
Attackers calling themselves the Guardians of Peace stole large amounts of internal data from Sony Pictures, leaked unreleased films, emails and employee information, and destroyed data on thousands of company computers with wiper malware.
Root cause and lessons2015 - Disclosed June to July 2015
US Office of Personnel Management
Attackers stole personnel records and background investigation files held by the US Office of Personnel Management, including the detailed forms people complete for security clearances.
Root cause and lessons2015 - 23 December 2015
Three Ukrainian regional electricity distribution companies
Attackers remotely operated circuit breakers at three Ukrainian electricity distribution companies, cutting power to customers.
Root cause and lessons2016 - February 2016
Bangladesh Bank, the central bank of Bangladesh
Attackers inside Bangladesh Bank's network used its access to the SWIFT interbank messaging system to send fraudulent payment instructions to its account at the Federal Reserve Bank of New York.
Root cause and lessons2016 - 21 October 2016
Dyn, a managed DNS provider, and the websites that relied on it
A large distributed denial of service attack hit Dyn's DNS infrastructure in waves, making many popular websites hard to reach for users in parts of the US and Europe.
Root cause and lessons2016 - 17 December 2016
A transmission substation in Ukraine's power grid
A year after the 2015 attack, a substation near Kyiv was hit by malware later named Industroyer or CrashOverride.
Root cause and lessons2017 - 12 May 2017
Organisations worldwide, including the UK National Health Service
WannaCry spread worldwide in a single day by exploiting a Windows SMBv1 flaw that Microsoft had patched in March 2017 (MS17-010).
Root cause and lessons2017 - 27 June 2017
Organisations in Ukraine and multinational companies with Ukrainian operations
NotPetya was pushed out through a compromised update of M.E.Doc, accounting software widely used in Ukraine, and then spread inside networks using stolen credentials and SMB exploits.
Root cause and lessons2017 - May to July 2017
Equifax and US consumers
Attackers exploited a known vulnerability in the Apache Struts web framework (CVE-2017-5638) on Equifax's online dispute portal, months after a fix was released, and spent weeks querying databases holding consumer data.
Root cause and lessons2017 - June and August 2017
A Middle East-based petrochemical facility (FBI)
Attackers moved through a petrochemical facility's IT and OT networks to reach the engineering workstation for its safety instrumented system, and deployed Triton to reprogram Schneider Electric Triconex safety controllers.
Root cause and lessons2018 - Intrusion from 2014, discovered September 2018
Marriott International (Starwood guest reservation database)
Attackers had been inside the Starwood Hotels guest reservation system since 2014, two years before Marriott acquired Starwood, and were not discovered until 2018.
Root cause and lessons2019 - March 2019, discovered July 2019
Capital One and its customers and applicants
An outside individual exploited a configuration vulnerability in Capital One's cloud environment to obtain credentials and copy data from cloud storage, according to Capital One.
Root cause and lessons2020 - Disclosed December 2020
SolarWinds customers, including US government agencies
Attackers inserted the SUNBURST backdoor into the build process for SolarWinds Orion, so customers received it inside legitimate, signed software updates.
Root cause and lessons2021 - Disclosed 2 March 2021
Organisations running on-premises Microsoft Exchange Server
Microsoft released emergency patches for four chained zero-day vulnerabilities in on-premises Exchange Server, often referred to as ProxyLogon, that let attackers take over servers and plant web shells.
Root cause and lessons2021 - 7 May 2021
Colonial Pipeline Company
A ransomware attack on Colonial Pipeline's business IT systems led the company to halt operations of its fuel pipeline, a major supplier to the US East Coast, as a precaution.
Root cause and lessons2021 - 2 July 2021
Managed service providers using Kaseya VSA on-premises, and their customers
Attackers exploited vulnerabilities in on-premises installations of Kaseya VSA, remote monitoring and management software used by managed service providers, and pushed REvil ransomware through it to the MSPs' customers.
Root cause and lessons2021 - Disclosed 9 to 10 December 2021
Organisations running software that included Apache Log4j 2
Log4Shell (CVE-2021-44228) was a remote code execution flaw in Apache Log4j 2, a logging library embedded in countless Java applications.
Root cause and lessons2022 - September 2022
Uber
An attacker used a contractor's corporate password, which Uber said was likely bought on the dark web after malware infected the contractor's personal device.
Root cause and lessons2022 - August to October 2022
LastPass and its users
Attackers first stole source code and technical information from LastPass's development environment, then used it to target a senior DevOps engineer.
Root cause and lessons2023 - From 27 May 2023
Organisations using Progress MOVEit Transfer, and the people whose data they held
Beginning on 27 May 2023, attackers exploited a SQL injection zero-day (CVE-2023-34362) in MOVEit Transfer, a managed file transfer product, installed a web shell called LEMURLOOT and stole data from many organisations.
Root cause and lessons2023 - September 2023
MGM Resorts International and Caesars Entertainment
In September 2023 MGM Resorts disclosed a cybersecurity issue affecting its US systems that disrupted hotel and casino operations.
Root cause and lessons2024 - Discovered 29 March 2024
Open-source software supply chain (Linux distributions shipping xz 5.6.0 or 5.6.1)
A software engineer investigating slow SSH logins found a backdoor in versions 5.6.0 and 5.6.1 of the xz compression library (CVE-2024-3094).
Root cause and lessons2024 - February 2024
Change Healthcare, part of UnitedHealth Group
Attackers used stolen credentials to log in to a Change Healthcare remote access portal on 12 February 2024 and deployed ransomware nine days later, according to written testimony by UnitedHealth Group's CEO to the US House.
Root cause and lessons2024 - 19 July 2024
Windows hosts running the CrowdStrike Falcon sensor worldwide
A defective content configuration update (Channel File 291) for CrowdStrike's Falcon sensor caused Windows systems that received it to crash and fail to restart normally.
Root cause and lessons2024 - April to June 2024
Organisations using the Snowflake cloud data platform
Attackers logged in to Snowflake customer accounts with credentials stolen by infostealer malware on employee and contractor computers, then stole data and extorted the victims.
Root cause and lessons2024 - Disclosed October to November 2024
Multiple US and international telecommunications companies
In November 2024 the FBI and CISA said their investigation had revealed a broad and significant cyber espionage campaign by PRC-affiliated actors who had compromised networks at multiple telecommunications companies.
Root cause and lessons2025 - April to May 2025
Marks and Spencer, the Co-op and Harrods
Attacks on three UK retailers in spring 2025 disrupted operations; Marks and Spencer paused online orders for weeks.
Root cause and lessons2025 - From July 2025
Organisations running on-premises Microsoft SharePoint Server
Attackers exploited a chain of vulnerabilities in on-premises SharePoint Server, known as ToolShell (including CVE-2025-53770), to run code remotely and steal ASP.NET machine keys, which let them keep access even after patching.
Root cause and lessonsFigures and attribution statements are those of the governments, courts, regulators, affected organisations and researchers cited on each entry, not CyberCertPrep's own assessments. Summaries and lessons are original material written by CyberCertPrep. CyberCertPrep is not affiliated with or endorsed by any agency, company or researcher cited.