Data breach case studies show why restoring systems is not the same as containing a leak. Medibank, Optus, Change Healthcare, 23andMe, Sony Pictures and Ashley Madison all experienced incidents in which stolen information was published online. Their disclosed financial consequences included response spending, customer support provisions, recovery estimates and settlements. Those figures measure different things, but the shared problem is clear: a technical incident can become an ongoing public content crisis.
These are public incidents compiled from published reporting. Content Removal was not involved in these cases.
This review focuses on information that was actually released, not simply accessed or claimed by an attacker. It does not link to stolen records, leak archives or attacker websites. The content lessons are general observations for businesses, founders and executives, not claims about what removal services could have achieved in these incidents.
If your business is facing published stolen material now, request a confidential assessment. Our data breach removal service addresses exposed content alongside the work of your incident response firm, breach counsel and insurer.
Data breach case studies at a glance
| Brand | Incident year | What was published and where | Reported financial consequence |
|---|---|---|---|
| Medibank | 2022 | Customer identity information and health claims data on a dark web forum | A$46.4 million in cybercrime costs in FY2023 and A$39.8 million in FY2024 |
| Optus | 2022 | Customer identity records in a text file on a data breach website | A$140 million provision for expected customer response costs |
| Change Healthcare | 2024 | Patient billing, insurance and medical information on a dark web leak site | US$3.1 billion in cyberattack costs for 2024 at parent UnitedHealth Group |
| 23andMe | 2023 | Customer profile data on hacking forums and an unofficial subreddit | US$46.75 million settlement agreement, subsequently reported as court approved |
| Sony Pictures | 2014 | Internal emails and documents, initially through torrent files and later a searchable public archive | US$35 million estimated recovery costs for the fiscal year ending March 2015 |
| Ashley Madison | 2015 | Account information, including personal details and sexual interests, posted online | US$11.2 million class settlement that received final approval |
These are not directly comparable final loss totals. A provision is money set aside for expected spending. A settlement is a defined resolution of claims. A recovery estimate is not a final audited lifetime cost. Australian dollar and US dollar amounts remain in their original currencies. None of these figures isolates the financial effect of publication from the rest of the breach.
Medibank: sensitive health data became public content
What happened
The Australian health insurer’s breach became a public exposure crisis when attackers began releasing customer files. In its November 2022 update, Medibank confirmed that files believed to have been stolen from its systems had appeared on a dark web forum.
What leaked and where
Medibank said the released sample included names, addresses, dates of birth, phone numbers, email addresses, some identity document information and health claims data. The company also warned that further releases were expected. These details come from Medibank’s own account of the published files, rather than an assumption that everything accessed was immediately made public.
The combination mattered. Identity information creates an exposure problem by itself. Connecting an identifiable person to health claims makes the material more intimate and the potential distress more serious.
Reported cost
Medibank reported A$46.4 million in cybercrime costs in FY2023 and A$39.8 million in FY2024. The reporting describes spending on security improvements, legal work and other related costs. These are historical annual amounts, not an estimate of the value of the stolen records or a final total for the incident.
Reputational and content aftermath
Medibank’s public response included an apology and a commitment to contact customers whose information appeared in the released files. Its update anticipated continued publication, making clear why customer communication could not end with the initial discovery.
For a healthcare brand, the content problem is inseparable from the people described in the files. Exposure is not just a corporate headline.
The content lesson: Highly sensitive records need to be assessed as harmful published content, not only as evidence of a security incident. The consequences extend to the people whose private lives appear in the material.
Optus: an attacker deleting a post did not undo publication
What happened
The Optus breach in September 2022 exposed customer information and triggered a major response. The publication stage was documented separately from the wider breach: an alleged attacker released customer records online before retracting the demand.
What leaked and where
The Guardian reported that 10,000 records were published in a text file on a data breach website. The file included names, dates of birth, contact details and identity document numbers.
The same report said the alleged attacker later deleted posts and claimed to have deleted their copy of the data. That was the attacker’s claim, not independent proof that every copy had disappeared.
Reported cost
Optus set aside A$140 million for expected customer response costs. The provision covered measures including identity document replacement, credit monitoring and an independent review.
It was a provision for the broader breach response, not a price assigned to the published sample. The reporting also noted that the financial effects of investigations were not included in that estimate.
Reputational and content aftermath
The Guardian’s account of the retraction also described concerns about scammers targeting customers. The abrupt change in the attacker’s public position did not provide a reliable basis for telling customers the exposure was over.
For any business, there is an important distinction between seeing a post disappear and establishing what material remains accessible elsewhere.
The content lesson: A deleted original post is not evidence that all distributed copies have vanished. Content exposure needs its own assessment, independent of an attacker’s assurances.
Change Healthcare: patient data surfaced during an operational crisis
What happened
The Change Healthcare ransomware attack in February 2024 disrupted a business that handles healthcare transactions. The incident also developed into a publication crisis involving private patient records.
What leaked and where
TechCrunch reported that an extortion group published files on a dark web leak site. The outlet said it had seen files containing patient billing information, insurance records, medical information and agreements involving Change Healthcare and its partners.
This was evidence of a published portion of the stolen material. It should not be read as confirmation that every record taken in the attack was publicly available.
Reported cost
UnitedHealth Group, Change Healthcare’s parent, incurred US$3.1 billion in cyberattack costs in 2024. That is a parent company figure for the broader incident, including its operational consequences. It is not the cost of the published files alone.
The scale illustrates how misleading it would be to reduce breach impact to the expense of repairing technology.
Reputational and content aftermath
When the files appeared, UnitedHealth said it was investigating the online claims and that there was no evidence of a new cyber incident, according to TechCrunch’s reporting. New publication therefore did not necessarily mean a fresh intrusion.
That distinction matters for crisis communication. A business can face a new wave of public exposure from an existing theft while still managing service disruption and customer questions.
The content lesson: Operational recovery and published data exposure are separate workstreams. Progress on restoring service does not establish that stolen information is no longer circulating.
If exposed files are creating a parallel crisis for your organization, speak with Content Removal confidentially about the content that is accessible and the outcomes that may be available.
23andMe: profile information became a targeted public leak
What happened
The 23andMe breach disclosed in October 2023 involved unauthorized account access and the downloading of customer information. Public reporting also documented the release of customer profiles outside the service.
What leaked and where
BleepingComputer reported that profile data appeared on hacking forums and an unofficial 23andMe subreddit. Its account described releases targeting people by ancestry and geography.
The same reporting discussed other information stolen during the breach, including health reports and raw genotype data. That does not establish that all of those categories were included in every publicly posted dataset. The confirmed publication discussed here concerns the released profile data.
Reported cost
The bankruptcy plan administrator agreed to a US$46.75 million settlement in 2026. Bloomberg Law subsequently reported court approval of the settlement, rounding the amount in its coverage.
This is a settlement amount, not the company’s total breach cost or a statement that the full amount was paid directly by the operating business without insurance or other funding.
Reputational and content aftermath
The documented targeting of ancestry groups made the publication more specific than an indiscriminate list of names. The way exposed information is grouped and presented can become part of the harm.
A privacy focused brand must also distinguish what was accessed, what was downloaded and what was actually posted. Treating those categories as interchangeable can make public explanations less accurate.
The content lesson: A leak’s context matters as much as its file type. Profile information grouped around sensitive identity characteristics requires careful assessment without repeating or amplifying the exposed material.
Sony Pictures: stolen emails became a searchable archive
What happened
The Sony Pictures attack in 2014 damaged systems and exposed internal information. The published material then acquired a second life beyond the initial releases.
What leaked and where
The Verge reported that internal emails and documents were initially distributed through torrent files and later republished in a searchable public archive. The material included sensitive executive conversations and private internal documents.
The important change was accessibility. Material that had been cumbersome to browse became easier to search. This page links only to reporting about that development, not to the archive.
Reported cost
Sony estimated US$35 million in recovery costs for the fiscal year ending March 2015. A company spokesperson said the figure primarily covered work such as restoring financial and IT systems.
That was a contemporary estimate for recovery spending. It should not be presented as a complete calculation of reputational damage, lost opportunities or every subsequent cost.
Reputational and content aftermath
The Verge’s account of the searchable republication described Sony’s objection to the further dissemination of stolen information. The reporting shows how a later publisher can make an old breach newly accessible.
The general risk for executives is not limited to a fresh theft. Private conversations can resurface in a different format, reach a new audience and renew scrutiny.
The content lesson: Republication can change a leak’s reach without adding new stolen information. An exposure assessment should distinguish the original release from later searchable copies and archives.
Ashley Madison: an account record was not proof of membership
What happened
The Ashley Madison breach in 2015 exposed information associated with a dating service built around discreet relationships. Publication created deeply personal consequences alongside the company’s commercial crisis.
What leaked and where
The BBC reported that account details were posted online, including names, addresses, dates of birth and sexual interests. The relevant point is that the information left the company’s systems and became publicly distributed material.
There is no need to reproduce records or point readers toward the files to explain the incident.
Reported cost
The company agreed to a US$11.2 million class settlement, which received final approval in November 2017. This is a defined settlement figure, not a full accounting of revenue effects, security spending or the personal losses experienced by affected people.
Reputational and content aftermath
The Guardian reported the company’s warning that a name or other information appearing in the release did not establish that the person was actually a member.
That qualification is central to responsible discussion of leaked databases. Authentic stolen material can still be misunderstood. A record is not permission to draw unsupported conclusions about a person’s conduct.
For a brand, the aftermath can therefore include both exposure of private information and damaging interpretations of what that information supposedly proves.
The content lesson: Removing exposed personal information and addressing misleading claims about it are related but distinct needs. Repeating a leaked record can deepen the harm even when the discussion is framed as commentary.
What these cases have in common
These incidents involved different businesses, different information and different financial consequences. They nevertheless show a consistent gap between containing an intrusion and containing the public material it leaves behind.
The published material deserves a separate assessment
A stolen database, a leaked internal email and a screenshot of a patient record are different content problems. The relevant questions concern what is accessible, whom it identifies, where it appears and whether the publication has been copied or repackaged.
Those questions sit alongside technical investigation. They do not replace it.
A financial headline is not a measure of personal harm
Response costs and settlements provide concrete evidence of business consequences. They do not put a reliable dollar value on embarrassment, loss of privacy or the effect of having sensitive information connected to a name.
Nor do they prove that publication alone caused the full reported cost. A credible data breach case study keeps that distinction visible.
Public exposure can outlast the original release
The Optus reporting illustrates the limits of an attacker’s deletion claim. The Sony reporting shows how later republication can change accessibility. The Change Healthcare reporting shows that a new release can emerge without evidence of a new intrusion.
For business leaders, the practical implication is a continuing need to understand the exposed content, rather than assuming that a single announcement or a restored system closes the matter.
Removal and search visibility are different outcomes
Removing a page or file from its source addresses that particular publication. Removing a Google or Bing result changes discoverability through that search engine, but does not itself delete the source. Neither outcome establishes that unrelated copies have disappeared.
Content Removal assesses leaked and stolen content on the open web, forums, paste sites, file hosts, social platforms and messaging channels. Dark web sources are assessed individually. We do not promise outcomes before reviewing the material.
Discuss exposed breach content confidentially
Content Removal works on the published content consequences of a breach, alongside your incident response firm, breach counsel and insurer. We do not provide forensic investigation, malware removal, decryption, ransom negotiation or legal advice.
Our scope can include leaked documents, exposed personal information, copied breach files, associated impersonation pages and harmful search visibility. Ongoing monitoring through Protection Plans can support attention to new exposure.
If stolen information is already online, request a confidential assessment. For more on our scope and the distinction between source removal and search visibility, visit data breach removal.
