The biggest cyber attacks in history were not won by superior code alone. Almost every one of them walked through a door that somebody trusted: a camera still using its factory password, a software update nobody questioned, a patch that sat uninstalled for two months, a payment instruction that looked routine. Ranked by scale, damage and legacy rather than money alone, the ten attacks in this countdown shut down fuel supplies, emptied a central bank account, exposed half a continent of personal records and destroyed centrifuges without a shot fired. Each one also left a practical lesson. For owners, managers and IT leads, those lessons are the real inheritance, and they are cheaper to learn here than in an incident report of your own.
In short: the biggest attacks, and the pattern behind them
Ten attacks define the modern era of cyber risk, and the five largest by combined scale, damage and legacy are these. Every entry in the full countdown below follows the same pattern: a trusted system, password, update or workflow was abused, and the businesses that limited the damage were the ones with patching, segmentation, verification and backups already in place.
- NotPetya (2017): total damage widely estimated above $10 billion, and the attack the White House called the most destructive and costly in history.
- Yahoo (2013): all 3 billion accounts breached, still the largest data breach ever recorded.
- SolarWinds (2020): a poisoned software update reached about 18,000 organisations, including US government departments.
- WannaCry (2017): more than 200,000 computers hit in about 150 countries in a single day.
- Equifax (2017): 147 million people exposed through a flaw that had a patch available for about two months.
How this ranking works
There is no official league table of cyber attacks, so this countdown ranks by three tests applied together. Scale asks how many systems, accounts or organisations were caught. Damage asks what it cost in money, downtime and destroyed data. Legacy asks what permanently changed afterwards: a law, an industry practice, a company’s value, or the way boards think about security. An attack can top this list on any two of the three. A pure ransom total is not enough on its own, which is why some very expensive ransomware incidents do not appear, while a botnet that stole nothing at all does.
10. Mirai (2016): the botnet built from factory passwords
In October 2016, a botnet called Mirai launched a distributed denial of service attack against Dyn, a company that ran part of the internet’s address book, the Domain Name System. Mirai was not sophisticated. It scanned the internet for cameras, digital video recorders and routers that still used their factory default usernames and passwords, logged in, and recruited them into an army of hundreds of thousands of compromised devices, the peak the US Department of Justice later recorded when Mirai’s creators pleaded guilty to building it. That army flooded Dyn with traffic until services that depended on Dyn, including Twitter, Netflix, PayPal, Spotify and Reddit, became unreachable for users across large parts of the United States and Europe. The outage lasted hours rather than days, and no data was stolen. Its place here is about legacy: Mirai’s source code was published, copycat botnets followed for years, and it taught the industry that any connected device with a default password is part of somebody’s attack infrastructure.
Lesson for businesses: default passwords on any connected device are an open door, and the device does not have to matter to you to be used against others, or against you. Change every factory credential on cameras, recorders, routers and printers on the day they are installed, keep internet of things devices on a separate network segment away from business systems, and include them in the asset list your IT support actually maintains. If a device cannot have its password changed, it does not belong on the network at all.
9. Bangladesh Bank (2016): the $81 million payment instruction
In February 2016, attackers who had penetrated the systems of Bangladesh Bank, the country’s central bank, used its own access to the SWIFT payment messaging network, as The Daily Star’s investigation of the official probe report details, to send 35 fraudulent transfer orders to the Federal Reserve Bank of New York. The orders totalled about $951 million. Most were blocked or flagged, but $81 million was paid out to accounts in the Philippines and laundered through Manila casinos. What stopped the rest was luck wearing two disguises: a spelling error in one transfer order, which used the word “fandation” instead of “foundation” and prompted a routing bank to ask questions, and a name on another order that coincidentally matched a sanctions list entry and triggered a review. The heist remains the clearest demonstration ever recorded that payment systems fail at the level of trust, not technology: every instruction arrived through the genuine channel, properly formatted, from the real bank.
Lesson for businesses: trusted payment and messaging workflows need out-of-band verification, because a genuine-looking instruction from inside your own systems is exactly how this attack works. Any change of bank details, and any payment above a threshold you set, should be confirmed by a callback to a number already on file, never a number in the requesting message. Split the duties so the person who sets up a payment cannot be the person who releases it. The control is a phone call; the failure it prevents is eight figures.
8. Yahoo (2013 and 2014): the largest breach ever
Yahoo holds a record nobody wants. In 2013, attackers breached Yahoo and took data covering every account on the platform. The company disclosed a breach in 2016 and only admitted the full scale in 2017: all 3 billion accounts, as Computer Weekly reported from the disclosure by Yahoo’s new owner, Oath. A separate 2014 breach had already exposed 500 million accounts. The stolen material included names, email addresses, dates of birth and hashed passwords, the raw material for years of credential stuffing and phishing against people who reused those passwords elsewhere. The business consequences were just as historic. The disclosures landed in the middle of Verizon’s purchase of Yahoo’s operating business, and the price was cut by $350 million to reflect the damage. Yahoo’s breaches remain the benchmark for two things at once: the largest volume of accounts ever taken, and the clearest evidence that slow, partial disclosure compounds the cost of a breach long after the attackers have gone.
Lesson for businesses: breach scale and disclosure delay destroy value. Assume that credential dumps from any large breach will be replayed against your staff and customers for years, which is one more reason unique passwords and multi-factor authentication matter more than password complexity rules. And if your business is breached, take the disclosure decision early and completely: Yahoo shows that the drip of revised numbers, 500 million, then one billion, then three billion, did more reputational damage than a single full admission would have.
7. Colonial Pipeline (2021): ransomware stops the fuel
In May 2021, the DarkSide ransomware operation encrypted systems at Colonial Pipeline, which carries about 45 percent of the fuel used on the US East Coast. Colonial shut the pipeline down for about six days while it worked out what was safe to restart, gas stations across the south-east ran dry, and panic buying did the rest. The company paid a ransom of about $4.4 million, roughly 75 bitcoin, hoping to speed recovery. The ending had a twist that is still rare enough to be newsworthy: as the US Department of Justice announced, investigators followed the bitcoin transfers and seized 63.7 of the bitcoins paid, worth about $2.3 million by the time of the seizure. Early notification to the FBI was one reason the recovery was possible at all. Colonial is the defining modern example of ransomware as a national operations story rather than an IT incident.
Lesson for businesses: ransomware is an operations crisis, not an IT ticket. What decided Colonial’s six days was not the ransom negotiation; it was whether systems could be isolated, understood and restarted safely. Segmentation between office systems and operational systems, tested offline backups, and a rehearsed decision about who may authorise a shutdown and a restart decide whether you close for a weekend or for a week. Notify law enforcement and your insurer early: the Colonial recovery happened because the FBI was involved while the money was still traceable.
6. Equifax (2017): the patch that waited two months
Equifax is the entry on this list that should make every IT lead uncomfortable, because nothing about it required genius. In March 2017, a critical flaw in the Apache Struts web software was disclosed and a patch was released. Equifax, which used Struts in its online consumer dispute portal, was alerted and ordered the patch applied. It was not applied to that system. From May 2017, attackers walked through the known flaw and spent about 76 days inside, undetected partly because an expired security certificate had blinded the traffic inspection that might have spotted them. They took personal data on about 147 million people: names, birth dates, addresses and, for most, Social Security numbers. As the Federal Trade Commission’s settlement announcement records, Equifax agreed to pay at least $575 million, potentially up to $700 million, and the total cost of the breach, including the security rebuild it was ordered into, has been reported at about $1.38 billion. The chief executive resigned.
Lesson for businesses: a known flaw with a patch available for about two months caused the worst identity breach in US history. Patch discipline is a board-level duty, not a background task. That means a real asset inventory, because Equifax did not know the vulnerable system existed in that state; a deadline for critical patches measured in days, with evidence of completion rather than an email saying it was handled; and working detection, because the attackers had 76 days. If your business cannot list every internet-facing system it runs, that gap is the finding.
5. SolarWinds (2020): the update that was the attack
Between March and June 2020, customers of SolarWinds’ Orion network management platform installed routine software updates that had been tampered with at the source. The tainted updates carried a backdoor, later called SUNBURST, into about 18,000 organisations that installed them. The attackers, attributed by the US government in April 2021 to Russia’s Foreign Intelligence Service, the SVR, were selective: a much smaller number of those organisations, under 100 by most official accounts, received follow-on exploitation. They included the US Treasury, Commerce and Homeland Security departments, along with major technology and security companies. As CISA’s advisory AA20-352A documents, the campaign gave the SVR long-term access inside some of the best-defended networks on earth, and it was discovered by a victim, the security firm FireEye, noticing an anomaly with an employee’s phone registration. The build system of a trusted vendor had been turned into the delivery vehicle.
Lesson for businesses: vendor and update trust is now a security control in its own right. You cannot refuse updates; SolarWinds is not an argument against patching. It is an argument for knowing which suppliers have privileged access to your network, for giving monitoring tools themselves least-privilege access and watching what they do, and for segmenting management systems so one compromised platform is not a master key. Ask your critical vendors how their build and signing process is protected. A vendor that cannot answer is a risk you have chosen.
4. MOVEit (2023): one flaw, 2,773 organisations
In May 2023, the Clop ransomware group began exploiting a zero day flaw in MOVEit Transfer, a widely used managed file transfer product from Progress Software, before a patch existed. They did not encrypt anything. They simply stole the files that organisations moved through the product and threatened to publish them. Because MOVEit sat inside payroll providers, health administrators, government agencies and service bureaus, one organisation’s compromise exposed data belonging to hundreds of its clients. Emsisoft’s running tally of the campaign reached 2,773 organisations and 95,788,491 individuals, nearly 96 million people, spanning education, health, finance and government on several continents. MOVEit was Clop’s third campaign against file transfer products, after similar attacks on other tools, which makes the pattern itself the story: a single niche product category, the one businesses use to move their most sensitive files, had become a mass exploitation target.
Lesson for businesses: third-party software risk is mass risk now. Know exactly which file transfer, remote access and edge tools your business runs, put them first in the patch queue the moment a critical flaw is announced, and ask whether each one still needs to exist. When a supplier moves your payroll or customer files, their incident is your incident and your notification duty, so contracts should say how fast they must tell you. The businesses that fared best in MOVEit were the ones that could answer, within hours, whether they ran the product at all.
3. Stuxnet (2010): the weapon that crossed an air gap
Stuxnet, discovered in 2010, is the oldest entry here and still the most technically remarkable. It was malware built to sabotage one target: the uranium enrichment facility at Natanz in Iran. The facility’s centrifuge control systems were not connected to the internet, an air gap that was supposed to make them unreachable. Stuxnet crossed it the ordinary way, on removable USB media carried in by people. Once inside, as Kaspersky’s Stuxnet analysis sets out, it used four separate zero day flaws, an almost unheard of concentration, and drivers signed with stolen code-signing certificates, to reach the industrial controllers and subtly change centrifuge speeds while reporting normal readings to operators. About 1,000 centrifuges were destroyed. No state has ever claimed responsibility; Stuxnet is widely attributed to the United States and Israel. Its legacy is the proof that cyber operations can physically break machinery, and that code written for one facility escaped into the wild, where its techniques were studied and reused by everyone.
Lesson for businesses: air gaps leak through people and media. Any environment that is isolated for safety, a factory floor, a building management system, a medical or lab network, still connects to the world through USB drives, vendor laptops and maintenance visits. Critical systems need media controls: scanned and approved removable media only, dedicated and inspected transfer machines, and the same suspicion applied to a contractor’s laptop as to an email attachment. Isolation is a layer, not a guarantee.
2. WannaCry (2017): 200,000 computers in a day
On 12 May 2017, the WannaCry ransomware worm began spreading at a speed the industry had not seen in years. It used a Windows flaw in the SMB file-sharing protocol, for which Microsoft had released a patch about two months earlier, to move from machine to machine without any user action. Within a day it had encrypted more than 200,000 computers in about 150 countries and was demanding $300 in bitcoin from each. Britain’s National Health Service was among the worst hit, with hospitals cancelling appointments and diverting ambulances. The outbreak slowed because of a fluke. Security researcher Marcus Hutchins noticed the malware queried a long, unregistered domain name before detonating, registered that domain himself for a few dollars, and the successful connection acted as a kill switch that stopped new infections spreading. WannaCry is a ransomware entry in the history books, but its real subject is an unpatched, widely known flaw meeting a worm, and luck filling the gap where patching should have been.
Lesson for businesses: luck is not a control. WannaCry ended because one researcher happened to find an off switch the authors left in. Nothing in your environment should depend on that. The machines that fell were the ones that had not applied a two-month-old patch or were running unsupported systems. Keep an inventory, patch internet-facing and widely deployed software first, retire end-of-life systems or isolate them completely, and treat a vendor patch for a wormable flaw as an emergency change, not a monthly routine.
1. NotPetya (2017): the most destructive attack in history
On 27 June 2017, users of M.E.Doc, an accounting package used across Ukraine, installed a routine update that had been poisoned at the supplier. What spread from it, NotPetya, wore the costume of ransomware but was built to destroy: the encryption it applied could not be reversed even if a victim paid, because no genuine recovery mechanism existed. From Ukraine it raced through global networks within hours. Shipping giant Maersk reported losses of about $300 million and rebuilt thousands of servers and tens of thousands of PCs in about ten days. Pharmaceutical company Merck reported about $870 million in impact. FedEx put the damage to its TNT Express unit at about $400 million. Total damage worldwide is widely estimated above $10 billion. In February 2018, the White House statement attributed NotPetya to the Russian military and gave it the description that settles this countdown: “the most destructive and costly cyber-attack in history.”
Lesson for businesses: a poisoned software update can turn malware destructive rather than ransomable, and then the only recovery is your own. The organisations that survived NotPetya with the least damage had two things: segmented networks that slowed or stopped the spread, and backups the malware could not reach, including, in Maersk’s famous case, one domain controller in a Ghana office that happened to be offline during the attack and held an undamaged copy of the directory. Do not rely on a power cut in another country. Keep tested, offline or immutable backups, and rehearse rebuilding, because the plan you have only read is not a recovery plan.
The pattern: every attack exploited trust
Read the ten together and a single theme runs through all of them. Mirai trusted factory passwords. Bangladesh Bank trusted its own payment channel. Yahoo’s attackers exploited credentials that people trusted across many accounts. Colonial trusted a flat network. Equifax trusted that a patch order had been carried out. SolarWinds and MOVEit and NotPetya all weaponised the trust placed in software and its updates. Stuxnet trusted removable media. WannaCry trusted that an old flaw would stay theoretical. The attackers changed every year; the habit of extending trust without verification is the constant, and it is why the companion guide to AI hackers and agent-run attacks reaches the same conclusion from the opposite direction: modern attacks industrialise an old weakness rather than inventing a new one.
The defences that recur are unglamorous and known. Patch on time, with proof, as the wider guide to cyber security measures for businesses sets out. Segment networks so one compromise is not every compromise. Verify payments and supplier changes out of band. Back up as if you will be hit, offline, and test the restore. Know your third-party tools and test your own defences, which is what the guide to types of penetration testing covers, and keep an eye on the current landscape of website security attacks to watch out for. None of the ten attacks on this list required the victim to be careless in exotic ways. They required one normal thing to be left undone. That is good news, because normal things can be scheduled, assigned and checked.
Frequently asked questions
What is the biggest cyber attack in history?
By damage, NotPetya. The June 2017 attack spread from a compromised Ukrainian software update to companies worldwide, caused total damage widely estimated above $10 billion, and was called the most destructive and costly cyber attack in history by the White House in February 2018. By data volume, the biggest is Yahoo, where attackers took records covering all 3 billion accounts.
How much damage did NotPetya cause?
Total damage is widely estimated above $10 billion worldwide. Individual companies reported losses in the hundreds of millions: about $300 million at Maersk, about $870 million at Merck and about $400 million at FedEx. Because NotPetya was destructive malware rather than working ransomware, most victims could not recover by paying, so the bill was dominated by rebuilding systems and lost operations.
What was the largest data breach ever?
Yahoo. The 2013 breach, whose full scale was admitted in 2017, covered all 3 billion Yahoo accounts, which remains the largest number of accounts in a single breach. A separate 2014 breach covered 500 million accounts. The disclosures also cut $350 million from the price Verizon paid for Yahoo’s operating business.
How many organisations did the MOVEit breach hit?
Emsisoft’s tally reached 2,773 organisations and 95,788,491 individuals, nearly 96 million people, in the 2023 MOVEit campaign. The Clop ransomware group exploited a zero day flaw in Progress MOVEit Transfer and stole data from thousands of organisations that used it, many of them handling data on behalf of other businesses.
What stopped WannaCry?
A domain registration. Security researcher Marcus Hutchins noticed that the malware checked a long, unregistered domain before encrypting, registered it himself for a few dollars, and the successful connection acted as a kill switch that halted new infections. It slowed the outbreak on its first day, but unpatched machines remained at risk wherever the underlying Windows flaw stayed unfixed.
What do the biggest cyber attacks have in common?
Trust. Each attack abused something the victim already trusted: factory passwords, a software update, a payment system, a vendor or an unpatched but familiar platform. The defences that recur are unglamorous: patch on time, segment networks, verify payments out of band, keep tested offline backups and know exactly which third party tools run inside the business.
