The 3 Biggest Data Breaches: Yahoo, Equifax and Capital One

Data breaches can happen to anyone at any time. How a company responds to them matters for its customers’ privacy and its own reputation. Three cases stand out because of their size, the sensitivity of the data and what they revealed about corporate security: the Yahoo breaches, the Equifax breach and the Capital One breach. This article reviews what happened, what penalties followed and what you should take from them in 2026. Figures reflect public reports and company disclosures.

1. Yahoo: billions of accounts

Yahoo disclosed in 2016 that a 2014 intrusion had exposed data on at least 500 million accounts, and in December 2016 and again in October 2017 revealed that an earlier 2013 breach had affected all of its roughly 3 billion accounts. The stolen data included names, email addresses, phone numbers, dates of birth, hashed passwords and, in some cases, security questions and answers. The disclosures came while Yahoo was being sold to Verizon, and the deal price was reportedly reduced by about $350 million. The company later agreed to pay $117.5 million to settle a class action in the United States. Read Yahoo data breach for more.

Lessons. Security questions are weak when answers are guessable or reused. Long delays in discovery and disclosure multiply harm. Unique passwords prevent one breach from unlocking others.

2. Equifax: the credit bureau

In 2017, Equifax announced that attackers had exploited an unpatched flaw in a web application framework and accessed data on about 147 million people in the United States, including names, Social Security numbers, birth dates, addresses and in some cases driver’s license numbers. A 2019 settlement with the FTC, the Consumer Financial Protection Bureau and states included up to $700 million, with funds for compensation and monitoring. The breach was especially serious because Social Security numbers and birth dates cannot be changed easily, and the company held data on people who never chose to be its customers. See Equifax data breach: millions still at risk and Equifax should pay more.

Lessons. Patch management is critical. Data on people who are not customers still needs protection. A freeze at the credit bureaus is the strongest personal defense; the steps are at IdentityTheft.gov and consumer.ftc.gov.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

3. Capital One: a cloud misconfiguration

In 2019, Capital One disclosed that an outsider had accessed data about roughly 100 million people in the United States and about 6 million in Canada. The intruder, a former cloud engineer named Paige Thompson, exploited a misconfigured web application firewall to reach data stored in the cloud. The data included credit card application information, with names, addresses, credit scores and, for a smaller group, Social Security numbers and bank account numbers. Thompson was convicted in June 2022 and was sentenced to time served. The Office of the Comptroller of the Currency fined Capital One $80 million in 2020, and the bank agreed to a $190 million class settlement. Read Capital One hacker caught red-handed.

Lessons. Cloud misconfigurations are a leading cause of breaches. Even leading financial institutions can fail on basics. Monitoring and access controls matter.

4. What the three cases have in common

Factor	Yahoo	Equifax	Capital One
Scale	About 3 billion accounts	About 147 million people	About 106 million people
Main cause	Intrusion and weak controls	Unpatched software flaw	Cloud misconfiguration
Sensitive data	Emails, birth dates, security answers	SSNs, birth dates, addresses	Application data, SSNs for some
Outcome	Settlement and sale discount	Up to $700 million settlement	$80 million fine, $190 million settlement

Common threads include slow detection, large retained datasets, incomplete security basics and penalties that arrive years later. Our article on data breaches result in huge costs and do big fines prevent data leaks? explain the economics.

5. Other breaches worth knowing

Other well-known incidents include the 2018 Marriott Starwood breach (see Marriott and NASA breaches), the 2022 Optus and Medibank breaches in Australia and the many incidents tracked in the worst year for data breaches. The FBI’s Internet Crime Complaint Center recorded 67,456 personal data breach complaints and $1.31 billion in losses in 2025, per ic3.gov.

6. Why old breaches still matter

Information leaked years ago continues to circulate and to be combined with newer leaks. A birth date and Social Security number from 2017 can still be used in 2026. Email addresses and old passwords are used in credential-stuffing attacks. Phishing messages draw on breach details to sound authentic. See how long can data leaks affect you.

7. What to do if you were affected

Freeze your credit at Equifax, Experian and TransUnion.
Change passwords you reused anywhere, and use a password manager.
Enable MFA, preferring authenticator apps or passkeys.
Monitor statements and credit reports through the official channel at consumer.ftc.gov.
Be wary of breach-themed phishing, and verify notices on official sites.
Claim an IRS Identity Protection PIN at irs.gov.
Report problems at IdentityTheft.gov.

8. Make leaked data less useful

Criminals who hold leaked data often need to match it to a current address, phone number and relatives. People-search sites make that easy. Remove your listings using official pages such as spokeo.com/optout, suppression.peopleconnect.us and thatsthem.com/optout. California residents can use DROP at privacy.ca.gov/drop. Ask Google to remove personal results. Recheck every 60 to 90 days. See data breach scrub after breach.

9. What companies should do

Companies can reduce risk by minimizing data collection, shortening retention, patching quickly, encrypting sensitive data, monitoring for unusual access, testing cloud configurations and notifying customers promptly. Customers can encourage change by choosing companies with good practices and by filing complaints with regulators such as the FTC at ftc.gov and the CFPB at consumerfinance.gov.

10. A worked example

Karen reads about a new retailer breach and remembers that her information was part of the Equifax incident years ago. She checks that her freeze is active, updates two reused passwords and removes her address from nine people-search sites. When a phishing email arrives mentioning a purchase she made, she recognizes the pattern and reports it. The cleanup takes an afternoon; the benefit is ongoing.

11. Myths about big breaches

“My data is old, so it’s safe.” Old data is reused. “The company paid, so it’s resolved.” Settlements rarely cover your time. “Only large breaches matter.” Small ones add pieces. “Credit monitoring is enough.” Freezes prevent more.

12. How breach penalties compare with the harm

It is worth putting the penalties in perspective. A settlement of hundreds of millions of dollars sounds large, but when divided across tens or hundreds of millions of affected people, individual payouts are small, and claims processes often reward only those who file. Fines paid to regulators fund enforcement rather than compensating victims. Meanwhile, the harm to individuals, from fraud attempts to the hours spent freezing credit and monitoring accounts, is spread over years. This mismatch is one reason regulators have moved toward requiring security programs, data minimization and independent assessments in settlements, and why states keep expanding breach notification and privacy statutes. You can follow enforcement news at ftc.gov and consumerfinance.gov.

13. Checking your own exposure

You can check whether your email appears in known breaches by using a reputable breach-notification service, and by reviewing notices you have received over the years. Make a list of services that have notified you, and make sure each password is unique and each account has MFA. Search your name to see what a criminal could match to leaked data, and remove listings that show your address and phone number. Revisit the list every few months. The Federal Trade Commission explains what to do after a data breach at consumer.ftc.gov, including step-by-step guidance for the type of information exposed.

14. Three scenarios

Scenario 1: You get a breach letter. Verify it, freeze credit and change passwords.

Scenario 2: You find your email in a breach checker. Change passwords and enable MFA for the accounts listed.

Scenario 3: A company offers free monitoring. Accept it, but still freeze credit.

15. What to expect: a realistic timeline

Action	Time to do	When it takes effect
Credit freezes	30 minutes	Immediate
Password and MFA updates	1 hour	Immediate
Broker opt-outs	2 to 4 hours	Days to 4 weeks
Rechecks	15 to 30 minutes	Every 60 to 90 days

16. Common mistakes

Waiting for a notice before acting.
Reusing passwords.
Skipping freezes.
Clicking links in breach emails.
Leaving public listings in place.

17. How Wiperts helps after a breach

Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, asks Google and Bing to remove personal results, blurs your home on maps and monitors 24/7 so relisted data is removed again.

See how easily leaked data could be matched to you.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

18. Key takeaways

Yahoo, Equifax and Capital One show how breaches scale and how late penalties arrive.
Freeze credit, use unique passwords and MFA, and watch for phishing.
Old breach data stays dangerous, so reduce your public footprint.
Recheck regularly.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

19. Frequently Asked Questions

Which are the biggest data breaches ever?

Rankings vary by method, but Yahoo’s 2013 breach, which the company said affected all 3 billion accounts, is usually first. Equifax and Capital One are landmark cases because of the sensitivity of the data and the penalties.

What happened in the Equifax breach?

In 2017 attackers exploited an unpatched web application flaw and accessed data on about 147 million people, including Social Security numbers and birth dates. A 2019 settlement included up to $700 million.

What happened in the Capital One breach?

In 2019 a former cloud engineer exploited a misconfigured firewall to access data on about 100 million people in the US and 6 million in Canada. The bank paid an $80 million fine and a $190 million class settlement.

Did anyone go to prison?

In the Capital One case, Paige Thompson was convicted in June 2022 and sentenced to time served. Large corporate breaches often end in fines and settlements rather than prison.

What should I do if my data was in one of these breaches?

Freeze your credit, use unique passwords with MFA, watch for phishing and monitor statements. Old breach data can still be misused.

Can breached data be removed from the internet?

Not fully, but you can remove public people-search listings so criminals cannot easily match leaked data to your current address.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing