Ten major 2023 cyber incidents, explained without pretending they are directly comparable. The common theme was not one dominant attack type, but the broad consequences of exposed infrastructure, trusted software, cloud identity, and support-system failures.
These ten incidents are best understood as a cross-section of 2023’s cyber risk—not a leaderboard of the “worst” breaches. They include attacks on exposed enterprise systems, a compromised software update path, cloud-email access, support-system access, data-extortion campaigns, and disruptive attacks on large consumer businesses. Their impact cannot be reduced to one number: an outage at a casino operator, stolen pension-related data, and a compromised signing environment are different kinds of harm.
As an Amazon Associate I earn from qualifying purchases.
For consumers and investors, the practical lesson is that a breach headline is only the start of the analysis. Ask what system was accessed, what data was actually taken, whether operations were interrupted, and whether the organization’s disclosure identifies a lasting remediation need. A patch may close a vulnerability; it does not necessarily remove an attacker who already established persistence.
Recommended Free Tools
2023’s major incidents at a glance
| Incident | When it became public or active | Primary mechanism | Why it mattered |
|---|---|---|---|
| ESXiArgs ransomware | February | Unpatched or out-of-date VMware ESXi exposure | Thousands of hypervisor servers were compromised globally. |
| GoAnywhere MFT | February | Zero-day remote-code-execution flaw | Managed file-transfer customers faced unauthorized accounts and file downloads. |
| 3CX supply-chain attack | March | Trojanized desktop application updates | A trusted software distribution channel became the delivery path. |
| MOVEit Transfer and Cloud | Late May onward | File-transfer vulnerability | Created a wide data-extortion campaign and many downstream disclosures. |
| PBI Research Services | MOVEit downstream case | Data exposure through its MOVEit use | Illustrated how one vendor incident can affect many pension and insurance-related clients. |
| Barracuda Email Security Gateway | 2023 | Appliance vulnerability and post-exploitation persistence | Some compromised appliances needed replacement, not just patching. |
| Microsoft cloud-email breach | May onward | Cloud identity and token-signing-key failure | Approximately 25 organizations’ email accounts were affected. |
| MGM Resorts and Caesars | September | Separate attacks with significant business and data consequences | Showed how a cyber incident can disrupt a consumer-facing enterprise. |
| Cisco IOS XE | October | Actively exploited Web UI vulnerability chain | Attackers could create an account, obtain root access, and install an implant. |
| Okta support system | September–October | Access to customer-support files | Put a critical identity provider’s support process in focus. |
Exposed infrastructure and file-transfer systems
1. ESXiArgs ransomware attacks
In February, CISA and the FBI said the ESXiArgs ransomware campaign had compromised more than 3,800 VMware ESXi servers globally. That figure is a server count, not a count of companies or individuals. Still, the event was a stark reminder of the concentration of risk in virtualization hosts: one compromised hypervisor can affect numerous virtual machines and business services.
#1 Best Overall
The exposure context was unpatched or out-of-date ESXi infrastructure. The defensive guidance was unusually concrete: update ESXi, disable Service Location Protocol where it is not needed, and do not expose the hypervisor directly to the public internet. For an organization, this is a management-plane problem rather than an ordinary endpoint-antivirus problem. Systems used to administer core infrastructure deserve especially narrow network access and an inventory that identifies unsupported versions before an attacker does.
2. GoAnywhere MFT attacks
Fortra disclosed that an unknown actor exploited the then-zero-day remote-code-execution vulnerability CVE-2023-0669 in its hosted GoAnywhere MFTaaS environment between January 28 and 30. The actor created unauthorized accounts and, for some customers, downloaded files. Fortra also learned of exploitation affecting a small number of on-premises implementations, with activity reported as early as January 18.
The important distinction is between the vulnerability and the exposure that made it reachable. Fortra identified internet-exposed administrative portals as a risk factor in the on-premises cases. Managed file-transfer systems are built to move sensitive files across organizational boundaries, so their administrative interfaces and service accounts warrant the same caution as an internet-facing identity system. Patching is essential, but so are restricting administration to trusted networks, reviewing account creation, and investigating unusual downloads.
3. MOVEit attacks—and the PBI downstream blast radius
The MOVEit campaign began in late May and centered on vulnerabilities in Progress MOVEit Transfer and MOVEit Cloud. Progress communicated CVE-2023-34362 on May 31, disabled web access to MOVEit Cloud while responding, issued a patch for MOVEit Transfer, then patched and re-enabled its cloud service. It instructed customers to patch and review logs for abnormal downloads.
The broader campaign was chiefly data extortion: the point was to obtain data and pressure victims, rather than to encrypt systems in the conventional ransomware pattern. That distinction matters when reading disclosures. A company may have had data taken even if its internal systems did not experience the familiar ransom-note-and-encryption outage.
PBI Research Services belongs immediately alongside MOVEit, not in a separate tally of unrelated root-cause campaigns. PBI used MOVEit in services for insurance and pension-related clients, and it became the largest single downstream MOVEit case in this accounting, with 13.8 million individuals ultimately reported as compromised. Such totals depend on the date and reporting methodology; they should not be treated as a universal, final measure of everyone affected by the wider MOVEit campaign.
For people whose retirement-plan, insurance, or other information was involved, the useful response is specific: read the notice to learn which PBI client relationship applied, what categories of information were involved, how long any offered monitoring lasts, and how to place a fraud alert or credit freeze if the disclosed data warrants it. Do not assume every MOVEit notice means the same data types were exposed.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Barracuda Email Security Gateway attacks
Barracuda’s affected product was its Email Security Gateway appliance, and CVE-2023-2868 was the relevant vulnerability. The most important operational lesson was the remediation requirement: Barracuda recommended replacement for compromised appliances, rather than treating installation of a patch as sufficient recovery.
This is a vital distinction in incident response. A patch removes the known vulnerable condition. It does not, by itself, prove that a previously compromised appliance is clean. When a vendor directs customers to replace equipment, finance and operations teams should treat that as a continuity, procurement, and evidence-preservation issue as well as a security ticket. The cost of replacement is part of the incident’s real business impact.
5. Cisco IOS XE attacks
In October, Cisco warned that attackers were actively exploiting two Web UI issues in IOS XE. The chain began with CVE-2023-20198, rated CVSS 10.0, to gain initial access and create a local account. Attackers could then use CVE-2023-20273 to elevate to root and write an implant.
Cisco’s mitigation was direct: disable the HTTP server feature on internet-facing systems, or, where the feature is needed, restrict it to trusted sources. The case reinforces a simple but often neglected governance point: a device’s web-management service is part of the attack surface, even if the device’s primary job is routing or switching. Public reachability, local accounts, configuration drift, and unusual management-plane changes should all be reviewable during an incident.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Trusted software, cloud identity, and support processes
6. 3CX software supply-chain attack
On March 29, 3CX said it had received reports that malicious activity was exploiting its product. The company identified affected Windows and macOS DesktopApp versions that had been shipped in 2023 updates and retained Mandiant to investigate. Later, 3CX reported Mandiant’s high-confidence assessment that the activity tracked as UNC4736 had a North Korean nexus.
Rank #3
That attribution should be read as an investigative assessment, not as courtroom-established fact. The broader lesson does not depend on attribution: software signed or distributed by a trusted vendor can become an attacker’s delivery channel. Organizations need a way to identify the exact application versions deployed, remove known-bad builds quickly, and investigate systems that ran them. A supply-chain compromise also tests whether a company’s security program can distinguish “approved software” from “software that remains safe after approval.”
7. Microsoft cloud-email breach
Microsoft said Storm-0558 accessed email accounts affecting approximately 25 organizations in its public cloud beginning May 15, 2023. In a later investigation update, Microsoft maintained that its leading explanation was that operational errors allowed key material to leave the secure token-signing environment and that it was accessed in a debugging environment through a compromised engineering account.
The wording matters. Microsoft later clarified that it had not found the specific crash dump previously discussed, so it is not accurate to present that older crash-dump explanation as settled fact. The stronger, current takeaway is that cloud identity systems concentrate trust: signing-key protection, engineering-environment controls, diagnostic data handling, account security, and log visibility can all affect the security of customer email access.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →For customers, this type of event calls for more than a password reset. Organizations need to assess suspicious mail access, preserve relevant audit data, review application and token activity, and understand what visibility their cloud subscription level provides. For investors and boards, the incident is also a reminder that a service’s security architecture and its operational controls both matter.
8. Okta support-system breach
Okta’s completed investigation found that a threat actor accessed files in its customer support system associated with 134 customers between September 28 and October 17. The company later revised the scope of exposure involving broader support-user contact data.
These are different measures and should not be collapsed into one headline number. The 134-customer figure concerns files accessed in the support system. The later disclosure concerns names and email addresses of support-system users. Support portals are high-value systems because troubleshooting packages can contain configuration data, HTTP archive files, session material, screenshots, or other details that help an attacker reach a customer environment.
The practical response is to minimize secrets in support uploads, sanitize diagnostic files where feasible, rotate credentials or tokens that may have been included, and verify who can access support cases. Identity providers are essential controls, but their surrounding support and administrative workflows need equally careful treatment.
High-disruption attacks on consumer-facing enterprises
9. MGM Resorts and Caesars
The September attacks involving MGM Resorts and Caesars illustrated the financial and operational consequences of cyber incidents at large consumer businesses, but their disclosures must remain separate. MGM reported a cybersecurity issue in a September 2023 Form 8-K. Caesars disclosed more specifically that an unauthorized actor acquired a copy of its loyalty-program database, including driver’s-license and/or Social Security numbers for a significant number of members.
It is not sound to treat the two events as one fully established incident, or to state common attribution, a ransom payment, or an exact customer count as fact without separate evidence. The useful comparison is operational: cyber risk can show up as service disruption, lost revenue, recovery expense, customer-data exposure, regulatory scrutiny, and damaged trust—often in different proportions at different companies.
For loyalty-program members, a breach notice should be evaluated for the actual data categories disclosed. A hotel or casino account may contain contact details, stay history, loyalty information, and potentially identity data. Reusing the same password across travel, retail, and financial accounts increases the cost of any account-related exposure; unique passwords and multi-factor authentication reduce that spillover risk.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What this list says—and does not say—about 2023
These incidents do not prove that one attack technique dominated 2023. They instead show several recurring operational weak points:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Internet-facing management and transfer systems: ESXi, GoAnywhere, MOVEit, Barracuda, and Cisco each underscore the danger of systems that administer infrastructure, move sensitive data, filter email, or expose a web-management interface.
- Trusted paths: 3CX demonstrated software-distribution risk, while Microsoft and Okta showed the importance of identity, signing, engineering, and support processes.
- Downstream concentration: The PBI case showed why a vendor incident can produce many client notifications without being a separate root-cause campaign.
- Business disruption is its own damage category: MGM and Caesars demonstrate that a breach assessment should not focus only on records or ransomware encryption.
It would also be misleading to rank every entry using a single metric such as records exposed, cost, or technical sophistication. A server count is not a victim count; a list of affected support customers is not the same as a count of contact records; and a disclosed data copy is not the same as a prolonged operational outage. The right comparison depends on the question being asked.
Best Value
A practical checklist for people affected by a 2023-era breach notice
- Confirm the sender independently. Visit the organization’s official site or use a phone number from a statement you already have. Do not rely solely on links in an unexpected email.
- Identify the data type. Separate a password or email address from a driver’s-license number, Social Security number, payment-card number, health information, or retirement-plan information. The appropriate response differs.
- Change exposed or reused credentials. Use a unique password for the affected account and enable multi-factor authentication where offered. Change any other account where that password was reused.
- Protect credit when identity data is involved. In the United States, consider a free credit freeze with each nationwide consumer reporting agency. A fraud alert is an alternative, but a freeze is generally the stronger default when the risk is serious and you do not expect imminent new credit applications.
- Read the offered-monitoring terms. Note what service is offered, when enrollment ends, what it monitors, and whether it includes identity-restoration help. Monitoring can alert you; it does not prevent all misuse.
- Watch the accounts that match the exposure. For a loyalty-program incident, monitor that account for unauthorized profile or redemption changes. For a pension or insurer notice, verify plan communications through established contact channels. For email exposure, be alert to convincing follow-up phishing.
- Keep the notice. Save a copy with the incident date, disclosed data categories, and enrollment information. It can be useful if fraudulent activity appears later.
Finally, a high-profile 2023 breach is not automatically part of this particular ten-item sampling. T-Mobile’s January event involved API access to limited account data, and 23andMe later confirmed an October breach, but neither belongs in this source-defined list. Excluding them is not a judgment that they were unimportant; it preserves the scope of the article.
Frequently Asked Questions
Are these the 10 biggest breaches of 2023?
No. This is a chronological sampling of ten major campaigns and disclosures with broad or multi-victim impact. It is not a ranking by records exposed, financial loss, technical severity, or disruption.
Was the PBI Research Services incident separate from MOVEit?
No. PBI Research Services is included as a major downstream case of the MOVEit campaign. It helps show the campaign’s blast radius, but it should not be counted as an unrelated root-cause attack.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does applying a patch always fully resolve an intrusion?
Not necessarily. Barracuda’s response to compromised Email Security Gateway appliances is the clearest example here: replacement was recommended for compromised devices. Patching fixes a vulnerability, but may not remove persistence established before the patch.
What should I do if I receive a breach notice?
Start with the organization’s official notice, determine exactly which information was involved, change any reused passwords, enable multi-factor authentication, and consider a credit freeze when sensitive identity data is exposed. Keep the notice and monitor the accounts most relevant to the data involved.
The Bottom Line
2023’s major incidents were not one story about ransomware or one story about stolen records. They were a warning that exposed administration, file-transfer systems, trusted software, cloud identity, and support operations can each become a route to broad harm. Measure every incident by the facts it discloses: the access path, the data involved, the operational disruption, and the remediation still required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
