The 33 Biggest Cyberattacks & Hacks in History (1988–2024)

Every era of computing has one attack that ended the innocence. This is the complete list.

Cybercrime today is one of the largest economies on Earth — annual damages are estimated in the trillions of dollars , larger than the GDP of most countries. But it didn’t appear fully formed. It was built, attack by attack, over nearly four decades. Each incident on this list taught criminals a new technique. Each forced governments to write new laws. Each pushed defenders to invent the security industry we have today.

This pillar page is the complete master list — all 33 attacks, ranked by chronology, with the headline facts for each. Every entry links to the deep-dive in the series where you’ll find the full story: how the attack actually worked, who did it, what it cost, who went to prison, and what it permanently changed.

Read the series:

• Part 1 — The Early Era (1988–1999): Morris Worm & Kevin Mitnick
• Part 2 — The 2000s (2000–2008): Love Bug, Estonia & the Card Heists
• Part 3 — 2009–2015: Stuxnet, Sony & the Age of Cyber Weapons
• Part 4 — 2016–2019: WannaCry, NotPetya & Mirai
• Part 5 — 2020–2021: SolarWinds, Colonial Pipeline & the Ransomware Wave
• Part 6 — 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor

The Complete Timeline

The Five Most Expensive Attacks Ever

The Largest Data Breaches Ever (by people affected)

The Eight Patterns That Explain 35 Years of Hacking

Reading all 33 stories back-to-back reveals the same failures again and again. Every modern security standard exists because one of these attacks proved it necessary.

1. Humans are the #1 attack surface. Mitnick in 1995, Lapsus$ in 2022, MGM in 2023 — a phone call beats a zero-day.
2. A password without MFA is an open door. Colonial Pipeline, Change Healthcare, Snowflake, MGM — four of the biggest recent attacks needed nothing more.
3. Patch what you know exists — and know what exists. Equifax and WannaCry were failures of inventory and patch discipline, not exotic genius.
4. Your vendors are your attack surface. SolarWinds, Kaseya, MOVEit, XZ: compromise one supplier, own a thousand customers.
5. Ransomware now targets infrastructure, not just data. Fuel (Colonial), meat (JBS), healthcare (Change) — extortion has merged with national security.
6. States hack companies for money, sabotage, and espionage. North Korea robs banks; Russia cuts power; China harvests clearance files.
7. Concentration creates catastrophe. One clearinghouse (Change), one file-transfer product (MOVEit), one DNS provider (Dyn/Mirai) — single points of failure now have national blast radii.
8. Assume you’re already compromised. Marriott was breached for four years before discovery; Equifax for 76 days; Yahoo for three years. Detection, not prevention, decides the damage.

The index that holds the canon together

As the index entry to this entire series, the 33-attacks compilation carries a structural lesson worth stating in its own chapter: incident catalogs function as curriculum, and their value compounds through cross-reference — every entry in this series teaches a doctrine that another entry tested, extended, or anticipated, and the reader who follows the links builds the connected model that isolated incidents cannot provide. The pattern-recognition payoff documented across the series (credentials, trust, detection speed, complexity — the four recursions) exists only at the catalog level, which is why this index exists and why its chapters cross-link as densely as they do.

The using instructions that the series has developed: read era-wise for the evolution of adversary economics, read cross-era by vector (credential, supply chain, session, identity process) for the doctrine threads, and read the playbooks (detection, response, governance) as the layer the incidents exist to justify. The recurring finding across all three readings, documented in every chapter: the same small set of failures and the same small set of controls, at every scale from the Morris Worm to the present — the record most encouraging and most demanding conclusion simultaneously, since everything needed is known and almost nothing needed is new.

The maintenance note that keeps an index honest: this record extends as the record extends, and the era chapters it anchors will age into future compilation entries of their own. The 2022-2024 chapter closes with agentic-security questions already opening the next one; the index will grow a spine for it; and the reader holding the four recursions will recognize the new entries as they arrive, which is the entire demonstrated value of the catalog and the closing argument this series makes for maintaining one.

Frequently Asked Questions

What was the biggest cyberattack in history?

By financial damage: NotPetya (2017), a Russia-attributed destructive attack on Ukraine that spread worldwide, causing an estimated $10 billion in losses. By data stolen: the Yahoo breach, which compromised all 3 billion user accounts. By physical impact: Stuxnet, which destroyed nuclear centrifuges.

What was the first major cyberattack?

The Morris Worm (November 2, 1988) is generally considered the first major attack on the Internet. It infected ~10% of all connected machines and led to the creation of CERT. (Earlier notable incidents include the 1986 Cuckoo’s Egg espionage case tracked by Clifford Stoll.)

Which country has committed the most state-sponsored cyberattacks?

No definitive count exists, but public attributions by the US, UK, and EU most frequently name Russia, China, North Korea, and Iran. Each has a signature: Russia (sabotage & espionage — Sandworm), China (mass intellectual-property espionage), North Korea (revenue generation — Lazarus), Iran (disruptive retaliation — Shamoon).

What is the largest ransomware attack ever?

WannaCry (2017) by raw machine count (230,000+ computers in 150+ countries), NotPetya (2017) by damage (~$10B), and MOVEit (2023) by number of victim organizations (2,000+).

Do companies get their ransom money back?

Rarely. The FBI recovered part of Colonial Pipeline’s ransom (~$2.3M of $4.4M). But most payments — JBS’s $11M, Change Healthcare’s $22M — are gone. This is why the debate over banning ransom payments continues.

Has anyone ever gone to jail for these attacks?

Yes. Morris got probation. Mitnick spent years in pre-trial custody. Gonzalez got 20 years. REvil members got 13+ years. Lapsus$ hackers received hospital and rehab orders. A Yahoo accomplice got 5 years. Indictments remain open against North Korean, Chinese, and Russian state hackers who will likely never stand trial.

What attack almost ended the internet?

The XZ Utils backdoor (2024). A nearly undetectable backdoor was planted in a core Linux library after a 2.5-year social-engineering campaign. One engineer’s curiosity found it weeks before it could ship inside major distributions.

What do all these attacks have in common?

Almost none required genius. A reused password, an unpatched server, a trusting help desk, an exhausted open-source maintainer. The biggest hacks in history were ordinary failures exploited at extraordinary scale. That is why the defenses are ordinary too: MFA everywhere, patch discipline, least privilege, backups, and rehearsed incident response.

Where to Start Reading

• New to security history? Start with Part 1 — the Morris Worm and Kevin Mitnick.
• Want the wildest stories? Part 4 (2016–2019) has WannaCry, NotPetya and Mirai.
• Want what’s relevant today? Part 6 (2022–2024) is practically a current-affairs briefing.

Last updated: rolling. Damage figures are best-available public estimates; nation-state attributions reflect formal government attributions and indictments, not convictions.

Related Reading

• What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
• Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
• 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
• Authoritative reference: CISA Known Exploited Vulnerabilities

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy