HSEC 690 Cyber || SDSU Homeland Security

skip to main content

photo of instructor

HSEC 690
Cyber Warfare & Cyber Terrorism

Check Schedule e-Sign Policies Objectives Syllabus

Cyber Timeline

1960s		1970s		1980s		1990s
1997	1998	1999	2000	2001	2002	2003	2004
2005	2006	2007	2008	2009	2010	2011	2012
2013	2014	2015

Timeline content protected by copyright; no duplication allowed without permission

1965		Vulnerability in Multics CTSS running on IBM 7094
1969	SEP	First node on ARPAnet (precursor to Internet) installed at Boelter Hall room 3420 at UCLA
1969	OCT	First transmission on ARPAnet from UCLA to SRI (Stanford Research Institute) over 50 kbps

1970		Xerox opens the Palo Alto Research Center (PARC) to advance research in computer science
1971		"Captain Crunch" (John Draper) popularizes blue boxes with 2600 Hz whistle from cereal box Electronic mail created by Ray Tomlinson at BBN (he selected the @ symbol to separate users from machines) ALOHAnet (precursor to WiFi and Ethernet) developed at University of Hawaii
1972		Steve Jobs asks Steve Wozniak to help create "Breakout" game for Atari
1973		Xerox PARC finishes creating the $40,000 "Alto" personal computer (first with GUI, Ethernet, laser printer) but later abandons project Apple Computer incorporated by Steve Jobs, Steve Wozniak, and Ron Wayne (who sold his 10% in company 12 days later)
1974		Vint Cerf designs Transmission Control Protocol (TCP) (interview with Vint Cerf nearly 4 decades later)
1975	MAR	Robert Metcalfe et al patents Ethernet while at Xerox PARC (inspired by ALOHAnet)
1976	APR	Steve Jobs and Steve Wozniak start Apple Computer
1977	APR	Apple II introduced at West Coast Computer Faire

1980		Apple Computer has largest IPO in history since Ford in 1956
1981		Germany's Chaos Computer Club forms IBM announces its first "Personal Computer" Micro Soft creates DOS
1982		Stolen source code from Canada (secretly modified by CIA) allegedly causes Soviet gas pipeline explosion in Siberia
1983		Movie WarGames released; in Jan 2010, Australia designs their Cyber Security Operations Centre to match U.S. House of Representatives begins hearings on hacking Domain Name System designed by Jon Postel William Gibson coins term "cyberspace" in novel Neuromancer
1984		Apple Computer introduces the Macintosh, the first commercially-successful personal computer with GUI Hacking magazine 2600 begins publication Stanford computer scientists Len Bosack and Sandy Lerner start Cisco Systems
1985		Symbolic.com becomes first domain name registered
1986		5,000 systems on the ARPAnet
1987		10,000 systems on the ARPAnet
1988		Morris Worm launched Huawei founded by Chinese military officer, starts building military communication networks AppleLink and PClink (precursors to America Online) dedicated online network created
1989		The Cuckoo's Egg by Cliff Stoll is published 100,000 systems on the ARPAnet

1990	NOV	Tim Berners-Lee creates the WorldWideWeb on a NeXT computer at CERN particle physics lab in Geneva, Switzerland
1991	MAY	Congressional report on Computer Attacks against Dept of Defense networks during First Gulf War
	AUG	First website goes online: a telephone directory for CERN (immediate success)
	SEP	20-Year-Old Julian Assange ("Mendax") caught hacking into Nortel
1992		Terminated employee hacks into and disables Chevron's Emergency Alert Network; sabotage unnoticed until actual emergency at Richmond, California plant happened and for ten hours, thousands in 22 states and Canada were at risk
1994		CheckPoint Software (Israeli) introduces first "stateful" firewall, Firewall-1 27-year-old hacker breaks into computers at Salt River Project, an Arizona water facility; later amplified and reported as the Roosevelt Dam (see 1998)
	FEB	Stanford Ph.D students Jerry Yang and David Filo create Yet Another Hierarchical Officious Oracle (YAHOO!)
	APR	Hackers penetrate U.S. Air Force's Rome Laboratory in New York using default guest account passwords and downloaded all user passwords Jim Clark and Marc Andreessen start Mosaic (later renamed Netscape) and launch the first commercial web browser
1995	AUG	Netscape IPO largest in Wall Street history (at the time): $1.96B
1995	SEP	Pierre Omidyar launches AuctionWeb (renamed eBay in 1997) from his San Jose living room
1996		Larry Page and Sergey Brin create BackRub search engine (later renamed Google) Sabeer Bhatia and Jack Smith create HoTMaiL (email over HTML) White Supremacist hacker retaliates after Massachusetts ISP prevents worldwide transmission of racist messages; hacker signed off with the threat, "you have yet to see true electronic terrorism. This is a promise."

1997		NYNEX hacked and cuts off Worchester Airport from FAA for 6 hours Eligible Receiver: Cyberattack simulation; DoD & Joint Command hacked in 48 hours Croatian teenager penetrates computers at US Air Force base in Guam
	APR	Virginia ISP accidentally announces ownership of entire Internet during Christmas Eve maintenance; Internet unstable for few hours
	OCT	Clinton Administration: President's Commission on Critical Infrastructure Protection

1998		Moonlight Maze: hacking into Pentagon, NASA, DoE begins (detected in 2000 and traced back to server in Russia) U.S. and NATO forces allegedly hack into Serbian air defense systems to confuse air traffic controllers and enable successful targeted during Kosovo (unconfirmed) Reports of 12-year-old attacking control systems for floodgates at Roosevelt Dam in Arizona, threatening to flood cities of Tempe and Mesa (untrue)
	FEB	Internet Software Consortium proposes DNSSEC to secure DNS Solar Sunrise attack begins with compromised MIT server and then spreads to 11 military computers
	SEP	Google Inc. formed as a play on word googol (1 followed by 100 zeroes)
	OCT	U.S. Attorney General Janet Reno announces National Infrastructure Protection Center U.S. Commerce Department creates ICANN and transitions DNS management authority to newly formed private entity

1999		Moonlight Maze: Pentagon, NASA, DoE Trojan code implanted by insider at Gazprom, Russia's state-run gas utility, allows hackers to control gas flows in pipelines
	MAR	Melissa worm
	MAY	Flawed U.S. intelligence leads to accidental bombing of Chinese embassy in Belgrade; catalyst in forming the Chinese "Honker Union" (literally, "red guest") hacktivist group
	AUG	Kevin Mitnick sentenced to 5 years
	SEP	Google search engine launched from beta Website defacement for US Embassy in China, referring to 1998 US Embassy bombings

2000	JAN	Clinton Administration: National Plan for Information Systems Protection
	FEB	Mafiaboy (Canadian high-school student) DDoS and shuts down Yahoo, Amazon, Dell, eBay, CNN, ETRADE, FIFA
	APR	Hacker dumps 264,000 gallons of sewage from Maroochy Shire into Queensland, Australia's Sunshine Coast (including public parks and hotels) for 3 months
	MAY	ILOVEYOU worm (originated in Philippines; possibly created as student thesis)
	NOV	In preparation for Salt Lake City Winter Olympics, officials run Black Ice simulation where SCADA systems attacked

2001	APR	Mid-air collision between U.S. Navy EP-3 SIGINT aircraft and Chinese J-8 interceptor fighter jet near Hainan province
	MAY	Chinese "Honker Union" hacktivists launch week-long "cyber war" of website defacement in response to April mid-air collision; Whitehouse, California DoJ, and an Ohio school district were also attacked
	JUL	Code Red
	SEP	NIMDA worm
	OCT	Bush Administration: Critical Infrastructure Protection in the Information Age

2002	FEB	Adrian Lamo compromises internal New York Times network, exploiting weaknesses found during two-minute scan "on a whim".
	JUN	Bush administration creates the Department of Homeland Security (responsible for critical IT infrastructure) Dave Hyatt starts the Mozilla Firefox project at age 17
	AUG	Adrian Lamo filmed NBC Nightly News with Tom Brokaw segment demonstrating hacking while breaking into NBC's network from a local Kinko's; segment is never aired over fears from NBC lawyers that they videotaped a crime
	OCT	DDoS attacks against all 13 root DNS servers; nine root servers fail, affecting worldwide traffic

2003	JAN	SQL Slammer worm Davis-Besse nuclear plant knocked offline 5 hours by SQL Slammer worm, penetrating unsecured network of contractor, through link to nuclear plant, bypassing firewalls (one week after same plant caused huge Northeastern U.S. blackout by high-voltage transmission line hitting trees)
	FEB	Dept of Homeland Security: National Strategy to Secure Cyberspace
	APR	PBS Frontline "Cyber war!"
	AUG	CSX loses signaling & dispatch control over 23 state railroad due to worm Tom Anderson and Chris DeWolfe create MySpace, hoping to improve on Friendster
	NOV	Titan Rain

2004		Titan Rain
	NOV	Mozilla releases Firefox 1.0: the first open-source and non-profit web browser
	DEC	Turkish ISP accidentally announces ownership of entire Internet during Christmas Eve maintenance; Internet unstable for few hours

2005	JAN	Titan Rain discovered
	FEB	Chad Hurley, Steve Chen, and Jawed Karim (all early PayPal employees) start YouTube
	JUN	CardSystems payment processor database breached exposing credit cards for 40M customers
	AUG	Zotob worm (Caterpillar, GE, UPS, DaimlerChrysler)

2006	JAN	UrgentComm: "SCADA systems are vulnerable to intrustion" Xforce Security: "SCADA Security & Terrorism: We're Not Crying Wolf" Con Edison accidentally "steals" network traffic from New York ISP
	APR	National Science and Technology Council: Federal Plan for Cyber Security and Information Assurance Research and Development
	MAY	Veterans Affairs database on stolen (unencrypted) laptop breached, exposing SSN and disability information for 26.5M retired and active-duty military
	JUN	US-CERT: "Information on SCADA can be found by determined attacker"
	AUG	AOL mistakenly posts 20 million search query history for 650,000 users for anyone to download; CTO forced to resign over the violation of customer privacy
	OCT	Wikileaks.org domain registered
	DEC	TJX Companies breach exposes 94M credit cards (Alberto Gonzalez) WikiLeaks publishes first document in online archive

2007	FEB	DDoS attack against root DNS servers for 24 hours; two root servers (G, run by DoD, and L, run by ICANN) fail National Cyber Response Coordination Group co-chair says the U.S. would consider launching a counter-cyberattack or bombing the source of the cyberattack
	MAR	Idaho National Lab: Project Aurora power generator experiment (not to be confused with the China/Google Aurora 2010 incident); CNN report (3:52); misconceptions explained
	APR	Estonia suffers massive DDoS after heated dispute with Russia over Soviet war memorial
	JUN	Spear phishing attack at Pentagon OSD (starting in April) steals sensitive emails and 10-20 terabytes
	JUL	3Com demonstrates SCADA flaws Fidelity National Information Services subsidiary Certegy Check Services suffers breach of 3.2M customer banking and credit card records after disgruntled contractor was fired (later sentenced to 4.5 years in prison)
	AUG	Phishing resulted in breach of Monster.com database of 1.3M job seekers
	SEP	Operation Orchard: Israel disables Syrian air defense with cyber attack (perhaps using "Suter" system to feed misleading data) before bombing North Korean-designed Dayr as-Zawr nuclear facility; vulnerability traced to trojan on Syrian official's laptop in hotel room in late 2006
	OCT	DoE Oak Ridge National Labs phishing attack compromises nonclassified databases
	NOV	ComputerWorld: "Insider charged with hacking california canal system" Solar Sunrise: teenagers penetrate USAF logistics at MidEast bases

2008	JAN	AP: "Hackers turn out the lights in multiple cities and demand extortion" Anonymous' Project Chanology attacks Scientology
	FEB	Pakistan Telecom accidentally hijacks YouTube network worldwide China PLA partners with Bain Capital to try to buy 3Com, which would give access to subsidiary TippingPoint, maker of intrusion prevention systems popular within .mil and .gov networks Chinese digital picture frame hardware shipped pre-installed with trojan to steal passwords
	MAR	Heartland Payment Systems breach exposes 134M credit cards (largest ever) via SQL injection by Alberto Gonzalez (and others)
	MAY	Emergency shutdown of Hatch nuclear plant SC Magazine: SCADA Vulnerability
	JUN	AP: "Security Hole Exposes Utilities to Internet Attack"
	AUG	Georgia suffers massive DDoS, coinciding with physical invasion by Russia
	SEP	Chinese hackers gain access to McCain and Obama campaign headquarters CENTCOM networks attacked by (supposedly) Russian malware AGENT.BTZ
	NOV	U.S. Military bans USB thumb drives on classified and unclassified systems
	DEC	CENTCOM computers penetrated with malware from USB drives scattered in parking lot CSIS: Securing Cyberspace for the 44th Presidency

2009	FEB	Conficker/Downadup Czech ISP SuproNet accidentally transmits very long BGP update; Internet unstable for an hour
	MAR	Univ of Toronto researchers uncover cyberespionage network "GhostNet" (Chinese suspected based on targets)
	APR	MS10-061 Chinese hackers break into F-35 Joint-Strike Fighter project, stealing terabytes of electronics designs Pentagon reports spending $100M in last six months to clean up cyber attacks (presumably from USB malware in Nov/Dec 2008) FBI uses custom-made CIPAV malware against extortionists and hackers (dating back to 2002)
	MAY	Chinese "secure operating system" KYLIN, developed to thwart cyberattacks from adversaries, discussed at U.S. China Economic and Security Review Commission (supposedly in development since 2001; in reality, a fork of Linux) Obama Administration: Cyberspace Policy Review African Network Operators' Group experimentally announces 4-byte ASN in BGP which crashes some routers
	JUN	Stuxnet: Early Strain Slowloris Apache DoS tool released
	JUL	South Korean and U.S. government websites attacked; initially, North Korea implicated China tries to force installation of Green Dam Youth Escort content-monitoring software on all new computers made in China, rescinds the order one month later
	AUG	Japanese ISP accidentally announces BGP empty route path; Internet unstable for couple hours
	NOV	PFC Bradley Manning allegedly exfiltrates 260,000+ diplomatic cables from classified database by burning to CDRW removable media labeled as "Lady Gaga" and pretending to sing along to nonexistent music
	DEC	Iraqi insurgents "hack" drone video (in reality, was sent unencrypted) Iranian Cyber Army compromises DNS reocrds for Twitter, redirects requests to propaganda

2010	JAN	Hydraq/Aurora: Google and 30+ companies breached by state-sponsored hackers linked to Chinese government Iranian Cyber Army compromises DNS records for Chinese search giant BAIDU.com Cybersitter (California tech company) sues China over Green Dam Youth Escort rip-off
	FEB	U.S. Military lifts ban on USB and removable media (prohibited Nov 2008) WikiLeaks releases first diplomatic cable allegedly from PFC Bradley Manning's exfiltration in previous months Chinese schools linked to Hydraq/Aurora and intellectual property attacks: Shanghai Jiaotong University (top CS program in country, winning awards from IBM) and Lanxiang Vocational School (school's network operated by company with strong ties to BAIDU)
	MAR	Obama Administration: Comprehensive National Cybersecurity Initiative (Unclassified) Hacking Australian energy company Rio Tinto Alberto Gonzalez sentenced to 20 years in federal prison
	APR	Hackers break into classified system as Indian Defense Ministry and Indian Embassies China Telecom BGP incorrectly asserts ownership of 15% of Internet for 20 minutes WikiLeaks releases "Collateral Murder" video of July 2007 Baghdad airstrike, allegedly stolen by PFC Bradley Manning
	MAY	NYSE flash-crash (Hindenburg anniversary) PFC Bradley Manning confesses massive data exfiltration during chat session with "grey hat" hacker Adrian Lamo
	JUN	Stuxnet (ver 2) Senator Lieberman proposes widely-criticized "Internet Kill Switch" bill (Protecting Cyberspace as a National Asset Act of 2010) and commented "Right now, China, the government, can disconnect parts of its Internet in a case of war. We need to have that here, too."
	JUL	WikiLeaks releases a portion of 91,731 documents ("Afghan War logs") via The New York Times, The Guardian, Der Spiegel Julian Assage places heavily encrypted backup copy of all diplomatic cables in concealed location on WikiLeaks' server and provides the password to a journalist writing a book (who later published the password in his book, Feb 2011)
	AUG	Jackpot ATMs European RIPE NCC announces BGP route with experimental attribute; Internet unstable for half-hour Virginia touchscreen e-voting machine reprogrammed to play PAC-MAN
	SEP	Microsoft patches vulnerabilities used in Stuxnet
	OCT	Stuxnet discovered Washington D.C. online voting system hacked by University of Michigan professor and two grad students during beta test; admin password was "ADMIN" WSJ: Hackers using ZeuS malware stole $12M from five US and UK banks WikiLeaks releases a portion of 391,832 documents ("Iraq War logs") via The New York Times, The Guardian, Der Spiegel
	NOV	Attacks on British Foreign Ministry and UK defense contractor spoofed as coming from the Whitehouse DoJ Operation In Our Sites shutters 82 sites providing unauthorized streaming sports video
	DEC	U.S. Military bans USB and removable media on all classified systems (again) Christmas Card email spoofed from Whitehouse includes ZeuS malware Java-based cross-platform exploit toolkit "Dragon Pack" Goldman Sachs programmer found guilty of stealing high-frequency trading software WikiLeaks supporters take down Mastercard.com Gawker blogs (Lifehacker, Gizmodo, etc) database breached, exposing email and passwords for 1.3M subscribers; cracked passwords later used successfully on social media sites Upset with autocratic leadership from Julian Assange, former WikiLeaks staff launch their own initiative, OpenLeaks

2011	JAN	CSIS: Cybersecurity Two Years Later Hackers breach Defense Research and Development Canada Canadian Finance Department and Treasury Board forced to disconnect from Internet Dating site PlentyOfFish.com penetrated, exposing 30M accounts
	FEB	Anonymous hacks HBGary Federal The Guardian publishes WikiLeaks: Inside Julian Assange's War on Secrecy and accidentally reveals password for heavily encrypted "failsafe" archive of all unredacted WikiLeaks data Hackers penetrate Australian Parliament email servers and Prime Minister Gillard's computer
	MAR	GhostNet Hackers penetrate RSA, searching for keys to SecurID tokens Hackers penetrate French government networks, searching for G-20 info Hackers penetrate South Korean defense networks, searching for info on US Global Hawk drone Iranian hacker penetrates Comodo CA and generates forged certificates Large mailing list service provider Epsilon was breached, exposing email addresses for millions; cleanup estimated at $4B
	APR	Obama Administration: National Strategy for Trusted Identities in Cyberspace MS10-061 Sony PlayStation Network penetrated and forced offline, with 77M accounts compromised L-3 Communications attacked using compromised SecurID tokens LulzSec steals information for 250k X-Factor contestants
	MAY	Citigroup breached and data for 200k customers stolen Lockheed Martin attacked using compromised SecurID tokens (and narrowly avoided penetration) Northrop Grumman attacked using compromised SecurID tokens Sony Online Entertainment penetrated, with 24.6M accounts compromised Sony Playstation Network brought online and then hacked again 3 days later LulzSec attacks Sony BMG (Europe), exposing PII LulzSec defaces PBS website after critical documentary on Wikileaks
	JUN	Dropbox security flaw allows unfettered access to all files for four hours using any password to any account Sony Pictures penetrated, with 4.5M accounts compromised Stuxnet detected by VirusBlokAda Chinese cyber spies spear-phish Gmail accounts for political activists, U.S. government officials, journalists Anonymous compromises Turkish Government website, to protest Internet censorship Anonymous compromises Spanish National Police website, in response to arrests of its members Anonymous compromises Malaysian Government website, in response for Wikileaks censorship Anonymous compromises Italian Prime Minister Berlusconi's website Anonymous compromises Brasilian Government website Anonymous compromises SEGA, exposing 1.3M users' email, DOB, passwords Anonymous steals emails containing scanned passport pages from Iraninan Ministry of Foreign Affairs LulzSec temporarily brings the CIA website offline LulzSec "doxes" Arizona Police Department, in protest of immigration law LulzSec "doxes" Peruvian Special Police Unit LulzSec "politely" attacks British National Health System Cyber-attack discovered at International Monetary Fund
	JUL	Department of Defense Strategy for Operating in Cyberspace Anonymous compromises Booz Allen Hamilton, exposing 90,000 military email/passwords Anonymous shut down Colombian President's websites Anonymous "doxes" 2500 Monsanto employees, in protest Anonymous compromises ManTech and IRC Federal (both FBI contractors) Anonymous compromises Italian Cyber Crime Police (CNAIPIC), in retaliation for previous arrests Pentagon reveals breach of 24,000 documents in March; classified weapons system must be redesigned Chinese hackers compromise South Korean social networking site Cyworld, exposing 35M PII
	AUG	Iranian hacker compromises DigiNotar CA, generating at least 531 forged certificates Chinese military accidentally show cyber attacks on U.S. target on state television
	SEP	Turkish hackers perform DNS hijacking for UPS, The Daily Telegraph, The Register, others Pro-Assad Syrian Electronic Army (SEA) goes after activists (reverse hacktivism?) Syrian Electronic Army DDoS'ed TalkingPointsMemo 700,000 websites defaced at once by Bangladeshi hacker TiGER-M@TE Mitsubishi Heavy Industries (Japan's largest defense contractor) compromised by Chinese hackers at its submarine manufacturing plant and Guidance Systems Works which makes parts for missiles SAIC reveals breach involving 4.9M patient records at military facilities in San Antonio, TX Anonymous vaguely tied to OccupyWallstreet movement
	OCT	Iranian hacker compromises DigiNotar CA, generating at least 531 forged certificates Creech Air Force Base (Nevada), Ground Control Station for drone flights, infected with keyloggers CCC discloses state-sponsored malware (R2D2) that German government uses to spy on Skype phone calls Symantec announces discovery of Duqu, successor to Stuxnet using much same technology Congressional commission reveals Chinese hackers interfered with two U.S. government satellites four times in 2008-2008 through ground station in Norway
	NOV	Compromised Certificate Authority DigiCert Malaysia allowed signed malware and generated weak certificates for Malaysian government SCADA water pump destroyed at Curran-Gardner Plant in Springfield, Illinois; by a Moscow-based hacker no less!; except it wasn't destroyed but rather burnt out on its own, and the tech that was troubleshooting was an authorized admin on vacation with his family in Russia SCADA water utility in South Houston, Texas hacked ISPs in West Bank and Gaza Strip attacked the day after UNESCO admits Palestinian Authority Adidas compromised, exposing 500k user accounts Norway confirms its oil/gas/energy sectors hit by cyber attack, exposing sensitive information Prolexic announces largest DDoS, against Asian customer and its DNS (7 days, 69Mpps, 46Gbps)
	DEC	China "Comment Crew" compromises nuclear planner's computer at Diablo Canyon Nuclear Plant via spear phishing attempting to identify operations, organizations, and identities for future attacks Iran captures U.S. spy drone RQ-170 using electronic warfare with a known GPS jamming/spoofing vulnerability STRATFOR compromised and forced offline, exposing PII for 860,000 users and 60,000 credit cards DDoS against Russian election monitoring websites after controversial Duma elections iBahn, provider of Internet for hotels, breached by Chinese hackers U.S. Chamber of Commerce reports breaches by Chinese hackers, obtaining info on its 3M members Chinese social networking site Tianya.cn compromised, exposing PII for 40M users Anonymous attacks SpecialForces.com, compromising 14,000 users and 8,000 credit cards Romanian hackers compromise 150 Subway restaurants, exposing credit card data on 80,000 customers

2012	JAN	Slow Read DoS technique discovered Saudi hacker steals credit card and PII for half-million Israelis; Deputy Foreign Minister of Israel declares breach "act of terrorism" Sykipot hijacks DoD smart card authentication Zappos.com hacked; 24M accounts compromised Hackers disrupt websites of Israel's stock exchange, national air carrier
	FEB	Wikileaks releases 5 million STRATFOR internal emails GlobalPayments merchant processor breached, disclosing 50,000 credit/debit customer cards; cleanup costs exceed $84M Anonymous eavesdrops on anti-Anonymous strategy conference call between FBI and Scotland Yard
	APR	Hacktivist "Hardcore Charle" breaches Chinese military contractor CEIEC, disclosing U.S. military convoy documents from Bagram Air Field and virtualization source code Flashback Java-based malware targets Mac users masquerading as Adobe Flash update Chinese "Honker Union" hacktivists deface Philippine government, police, and university websites in apparent retaliation for standoff regarding Huangyan Island California's Diablo Canyon Nuclear Plant taken offline due to jelly-fish like creatures; no cyber link (yet)? Vint Cerf, Internet pioneer, inducted into Internet Hall of Fame
	MAY	Flame malware latest in Stuxnet-like state-sponsored cyberespionage "weapons" CNN Anderson Cooper tricked by hacktivists that impersonated head of Disabled Veterans National Federation by hijacking email and sending lyrics to "Careless Whispers" (start watching at 03:11)
	JUN	LinkedIn password breach affects 6.46M users; cleanup costs exceed $3M eHarmony password breach of 8M hashes; passwords converted to uppercase and hashed without salt Last.fm suspects password breach, forces users to change passwords Chinese "Honker Union" hacktivists attack over 1,000 Vietnamese websites in retaliation for incursions into South China Sea
	JUL	Yahoo password breach affects 453,000 users; passwords stored unencrypted; later sued for negligence Formspring breach affects 420,000 users; passwords SHA-256 hashed with salt; to be safe, upgraded to bcrypt hash and forced all 28M users to change password FBI (finally) shuts-off "DNSchanger" servers in highly-publicized (but ultimately uneventful) awareness and coordination campaign Mom "hacks" into school and changes grades (30th anniversary of movie WarGames a coincidence?) Chinese "Comment Crew" Byzantine Candor accessed emails from EU Council members during Greece bailout
	AUG	Reuters blog and Twitter hacked three times in two weeks by Syrian Electronic Army (SEA) Dropbox hacked (again) using previously disclosed passwords from other services, shining light on password reuse problem Hackers take over journalist Mat Honan's digital life, delete everything (cyber terrorism? cyber extortion?) Hacktivists spread disinformation through hijacked news websites and Twitter Hacktivists attack Saudi Aramco internal network and infect 30,000 workstations with Shamoon malware
	SEP	"Aurora" hackers from Jan 2010 continuing cyberespionage; with eight new 0-days used since by same APT group called the "Elderwood Project"; compromised Amnesty International's Hong Kong site and would later infect CFR site in December. Chinese "Honker Union" hacktivists deface 19 Japanese government, court, and hospital websites in apparent retaliation for standoff regarding uninhabited Diaoyu islands Chinese "infiltrated" Whitehouse Military Office network via spear phishing; turns out it was not a classified network and not really a big issue
	OCT	Team Ghostshell publishes 120,000 records from Harvard, Cambridge, Stanford, Princeton, Johns Hopkins, and UPenn exposing 40,000 users in "Project WestWind" using basic "Google hacking" SQL injection techniques Largest bookstore in the world + 62 other Barnes & Noble stores had 7,000 PIN pads replaced by skimmers Nationwide Mutual breach exposes SSN information on 1.1M customers White House Military Office unclassified network attacked via successful spear phishing Unencrypted NASA laptop stolen containing sensitive information; agency redoubles efforts to encrypt all laptops even though they promised to do it after the March 2012 data breach
	NOV	South Carolina breach exposes tax records for 3.8M residents (78% of population); incident began with employee falling for spear phishing attack; legislators pledge to "spend whatever it takes to prevent another massive security breach" Anonymous hacktivist group #OpIsrael defaces Israeli websites in retaliation for cutting Internet access to Gaza Strip; Pakistani hacktivists also joined in defacing websites French President Sarkozy links outbreak of "Flame" malware on his campaign computers to U.S. cyberespionage, "categorically refuted" by U.S. Embassy in Paris; infection was due to campaign staffer falling for fake Facebook request, but incident is breathlessly reported as a potential "cyberwar" EU Internet Governance Forum members hacked during conference on web security Hactivists GhostShell exposed 2.5M records from Russian law enforcement, legal, political, and education industries in "Project Blackstar" Egyptian hacker "ViruS_HimA" breaches database for Adobe Connect online users' forum (hashed with MD5, no salt); leaks 644 records of 150,000 and tries to draw attention to .mil and .gov email addresses with weak passwords Critical Windows 8 0-day vulnerabilities patched, just one week after release of new OS NYPD officer used sensitive (poorly shredded) warrant records as confetti during Macy's Thanksgiving Parade Samsung and Dell printers have hard-coded backdoor password that allow anyone to take control Anonymous hacktivists launch #OpSyria in retaliation for cutting Internet Vulnerability assessment team at Argonne National Lab use $26 worth of electronics to tamper with and "hardware hack" popular e-voting machines used by 35+ million Ohio e-voting machines receive "uncertified, untested, experimental" software update one week prior to Presidential Election Malware (allegedly Chinese) on JAXA Japanese Space Agency computers stole designs for ¥15 Epsilon rocket system Photoshoot with Prince Williams reveals military password taped to wall
	DEC	Hacktivists al-Qassam Cyber Fighters launch DDoS attacks on U.S. banks including JPMorgan Chase, Bank of America, Citigroup, Wells Fargo, PNC, BB&T, and SunTrust; no big deal although misleading headlines abound Hacktivists GhostShell expose 1.6M records from NASA and others in "Project White Fox" Compromised Certificate Authority TURKTRUST allowed *.google.com domain to be issued, allowing MiTM attacks Swiss spy agency warns U.S. and Britain about massive data leak where disgruntled tech downloaded and walked out the door with several terabytes of classified information (reminiscent of Bradley Manning) Data breach at U.S. Army Fort Monmouth affects 36,000 people, disclosing SSN and salary information Council on Foreign Relations suffers 'waterhole' style attack whereby a legitimate site is compromised by malware, intended not for the site itself but for others who visit the site; similar malware on U.S. gas turbine manufacturer Capstone Turbine China tightens "Great Firewall" by blocking VPN connections (also attempted in May 2011) U.S. Secret Service admits that two backup tapes storing sensitive information were lost on the DC Metro in 2008, as part of a "disk shuffling" system to transfer information to an off-site backup facility Industrial heating systems directly connected to Internet can be remotely controlled by attackers with convenient GUI that shows floorplan and employee names

2013	JAN	Operation Ababil: U.S. Banks continue to be target of DDoS from hacktivist group al-Qassam Cyber Fighters; some quick to label this "cyber jihad" and characterize attack as "sophisticated" (inaccurate) or "fire-breathing Godzillas" tied to Iran (with no evidence at all); while solution is same as always Data breach at Cupid Media exposes 42,000,000 passwords McAfee predicts Cyber "cold war" will give way to more nation-state actions; also discusses ransomware, (cybercrime, not cyberwarfare) U.S. ICS-CERT reports SCADA attacks on critical infrastructure increased 52% (to 198) in 2012
	FEB	Mandiant releases unprecedented report exposing "APT1" hacker group (provides evidence to identify APT1 as the Chinese PLA unit 61398)
	MAR	Reddit founder, Internet prodigy, RSS inventor Aaron Swartz commits suicide (facing 35-year prison sentence for downloading academic journal articles from JSTOR) 32,000 South Korean computers hit by "logic bomb" malware (attribution unclear, but North Korea blamed even though attacking IP was in China) Syrian Electronic Army (SEA) hijacks BBC Weather Twitter
	APR	North Korea readies missile launch as fears of cyberwar grow (or could just be standard saber-rattling) Anonymous hijacks North Korean central news agency Twitter and Flickr accounts and deface some websites Syrian Electronic Army (SEA) hijacks NPR and Human Rights Watch Twitter Syrian Electronic Army (SEA) hijacks Associated Press (AP) Twitter, posts fake tweet about Obama being injured (causes $136B dip in NY stock exchange) Syrian Electronic Army (SEA) hijacks The Guardian Twitter plus 11 others
	MAY	Syrian Electronic Army (SEA) hijacks The Onion Twitter (editors struck back with satirical quote from SEA)
	JUN	Anonymous tries and fails to hack North Korean military (accidentally hacks some friendly South Korean sites)
	JUL	Syrian Electronic Army (SEA) hijacks Thomson Reuters Twitter Syrian Electronic Army (SEA) steals 1.5 terabytes from Tango chat app (also defaces Viber VoIP app, both popular in Middle East) al-Qassam Cyber Fighters continue Operation Ababil DDoS of U.S. banks (provide complex "invoice" formula for "payback" against views of "disrescpectful" YouTube video)
	AUG	Security researchers warn about Snapchat API vulnerability (in December, will lead to 4.6 million users exposed) Syrian Electronic Army hijacks TIME, CNN, Washington Post by infiltrating shared advertising platform Outbrain New York Times and Twitter hijacked by Syrian Electronic Army by changing DNS entries Review of Syrian Electronic Army "outage summer"
	SEP	FBI injected malware to target users of ToR anonymity network; took over notorious servers at Freedom Hosting (allegedly serving 95% of all child porn on darknet)
	OCT	Data breach at Adobe exposes 138,000,000 passwords (largest breach in history)
	NOV	Jeremy Hammond sentences to 10 years for Dec 2011 hack of STRATFOR (was coerced by Sabu from LulzSec while he was an FBI informant)
	DEC	Researchers show Computers Can Be Hacked Using High-Frequency Sound (but is it practical?) In-depth article about Glen Greenwald and Edward Snowden: The Men Who Leaked The Secrets Target stores announce breach of 40,000,000 credit cards between Black Friday and December 15 Snapchat database of 4.6 million usernames and phone numbers leaked (Database posted online) "Paunch" the 27-year-old Creator of Famed Blackhole Exploit Kit, Arrested (earned $50,000/month from customers)

2014	JAN	OpenSSL website defaced, but source code repositories untouched (turns out the hosting company had extremely poor security best practices on the hypervisor) Syrian Electronic Army (SEA) takes control of Skype Twitter (with 3M followers), anti-Microsoft status re-tweeted 8,000 times Syrian Electronic Army (SEA) hijacks Microsoft News Twitter accounts as well as blogs.technet.com Target announces another breach of 70,000,000 "guest" records including emails (which many combine with earlier 40M to arrive at 110M, but not necessarily true) Neiman Marcus announces its own credit card data breach which is likely to be smaller than Target's although no specifics announced POS breach at craft store Michael's (most recently in 2011) Syrian Electronic Army (SEA) takes control of CNN twitter (with 11M followers)
	FEB	Syrian Electronic Army attempts to hijack Facebook.com domain name (but is unsuccessful) Syrian Electronic Army steals 1M user records from Forbes (but passwords were salted and hashed) Edward Snowden tricked NSA coworkers into divulging passwords (likely using a keylogger) Kickstarter password breach (recommend using 1Password or LastPass for unique passwords per website)
	MAR	Sally Beauty Stores suffers data breach
	JUN	P.F. Chang's suffers data breach
	JUL	Israeli Iron Dome defense contractors suffer data breach
	SEP	Home Depot suffers data breach affecting 56 million customer credit cards Jimmy John's suffers data breach
	OCT	Kmart suffers data breach Dairy Queen suffers data breach Municipal Bond Insurance Association suffers data breach
	DEC	Staples suffers six-month data breach affecting 1.2 million customers Park-N-Fly suffers data breach affecting customers Bebe Stores suffers data breach

2015	FEB	Anthem Health data breach exposing 80 million unencrypted medical and subscriber records Gemalto, maker of SIM cards, reports it had its cryptographic keys stolen in 2010-2011, likely by a foreign intelligence service
	MAR	Mandarin Oriental Hotels suffer data breach of customer's credit card data Premera Blue Cross data breach exposing 11 million unencrypted medical and subscriber records
	MAY	Adult Friend Finder data breach affects 4 million users of the dating website, including those that asked for profiles to be deleted IRS data breach affects 300,000 taxpayers using "Get Transcript" feature CareFirst Blue Cross data breach exposing 1.1 million unencrypted subscriber records
	JUN	Office of Personnel Management (OPM) suffers a massive data breach affecting nearly 22 million holders of government security clearances (including at least 5 million fingerprint files). Kaspersky Labs discovers "Duqu 2.0" within their network, and suspect research data breach LastPass data breach exposes some user's email addresses and encrypted master passwords (although they were properly salted and hashed, so no data was actually lost -- I still recommend LastPass or 1Password)
	JUL	The Hacking Team, known for selling surveillance tools to dodgy governments, suffers a 400 GB data breach of its sensitive customer information Chris Valasek and Charlie Miller demonstrate remote control exploit of 1.4 million Jeep vehicles
	AUG	Ashley Madison adultery website suffers a massive data breach affecting nearly 32 million
	OCT	CIA Director John Brennan has his private AOL email breached, exposing sensitive (but unclassified) information Experian data breach affects 15 million T-Mobile customers Trump Hotels suffer year-long data breach of customer's credit card and reservation data Scottrade suffers data breach affecting 4.6 million
	NOV	VTech, maker of digital toys for children, admits data breach exposing data from 6 million parents Starwood Hotels suffer data breach of customer's credit card data Hilton Hotels suffer data breach of customer's credit card data
	DEC	Backdoor Discovered in Juniper Firewalls Hyatt Hotels suffer data breach exposing customer's credit card data Landry's Restaurants (Claim Jumper, Morton's, McCormick & Schmick's) suffer data breach exposing customer's credit card data