The year 2024 saw some of the biggest ransomware attacks, affecting Fortune 500 companies, schools, hospitals, and government organizations. These incidents caused massive disruptions and led to substantial financial losses and confidential data breaches.
Read on to learn more about the biggest attacks, what happened, and how to stay safe in 2025.
1. Change Healthcare
When: February 2024
What happened: Change Healthcare, a major healthcare technology company owned by UnitedHealth Group, suffered a catastrophic cyberattack that disrupted healthcare operations across the United States and leaked the personal data of 190 million individuals.
The ransomware attack forced the company to take all its systems offline, affecting prescription processing, medical claims, and payments at thousands of US pharmacies, hospitals, and healthcare providers.
The disruption was so severe that the US Department of Health and Human Services had to declare a state of emergency.
Cost: The organization spent $3.1 billion responding to the attack, making it the most expensive cyberattack in healthcare history.
2. Blue Yonder
When: November 2024
What happened: The supply chain software provider experienced a severe cyberattack that impacted major retailers including Starbucks and Morrisons.
The incident disrupted inventory management systems and ordering platforms, leading to stock control issues and delivery delays. Several UK supermarkets reported empty shelves and logistics problems, and Starbucks had to schedule and pay baristas manually.
This incident is a good example of how supply chain attacks constitute a major risk, as cybercriminals increasingly target vulnerabilities in third-party software, hardware, and services.
Cost: Unknown, but likely extremely high, with an estimated 3.5M companies affected.
3. CDK Global
When: June 2024
What happened: CDK Global, one of the largest providers of automotive dealership management systems, experienced a severe cybersecurity incident that disrupted operations at thousands of car dealerships across North America.
The attack affected dealership management systems, causing widespread disruption to vehicle sales, service scheduling, and parts inventory management.
The attack impacted approximately 15,000 dealerships and resulted in multiple class-action lawsuits from affected customers.
Cost: CDK reportedly paid $25M to end the ransomware attack but the total costs will be higher, with the CEO promising compensation for affected customers.
4. LoanDepot
When: January 2024
What happened: The major mortgage lender suffered a cyberattack that disrupted its loan processing systems throughout the US.
LoanDepot was forced to shut down its online platforms, forcing home buyers across the US to postpone their plans. The incident also compromised sensitive customer information, including social security numbers, loan applications, and financial records of 17 million customers.
Cost: LoanDepot reported losses of $27 million connected with the attack.
5. Snowflake
When: April 2024
What happened: The cloud data service provider suffered a significant breach when attackers gained access through a compromised third-party contractor account.
Attackers used info-stealer malware to access unencrypted Snowflake credentials stored on Jira from a contractor’s computer.
The breach affected up to 165 organizations storing data with Snowflake, including major companies like Santander Group, Ticketmaster, and Advance Auto Parts.
Cost: While the total costs are unknown, hackers were reportedly demanding up to $5M in ransoms from ten Snowflake customers. Snowflake faced lawsuits and significant reputational damage, with its stock falling 5% following breach disclosures.
6. AT&T
When: April 2024
What happened: The telecommunications giant suffered a major data breach when threat actors accessed and downloaded call logs and text records of approximately 109 million customers, including call duration, phone numbers, and cell site identification numbers.
The incident affected nearly all AT&T mobile clients and customers of mobile virtual network operators (MVNOs) using AT&T’s network.
While the records didn’t contain sensitive information like Social Security numbers or customer names, the communications metadata could potentially be connected with publicly available information to figure out identities.
Cost: Reports indicate that AT&T paid $370,000 in ransom after negotiating down from an initial $1 million demand.
7. Transport for London
When: September 2024
What happened: The transportation authority experienced a major cyber incident that disrupted London’s transit payment systems and real-time travel information.
The attack affected Oyster card services, contactless payments, and the TfL Go app, forcing millions of commuters to use cash or find alternative travel methods. Service disruptions lasted for five days, causing significant chaos across London’s transportation network.
Cost: The incident led to an estimated loss of £30 million ($38 million) in revenue and recovery costs.
8. UK Ministry of Defence
When: May 2024
What happened: The MoD suffered a significant data breach when attackers compromised a third-party payroll system containing sensitive personnel information.
The attack exposed personal data of approximately 270,000 serving personnel, reservists, and veterans, including names, bank details, and in some cases, addresses and national insurance numbers.
Cost: The exact costs are unknown but the attack is worrying due to its implications for national security.
9. Lurie Children’s Hospital
When: January 2024
What happened: The major Chicago pediatric hospital fell victim to a cyberattack that forced it to declare an internal disaster and operate under emergency procedures for several weeks.
The incident severely disrupted hospital operations, forcing them to reschedule surgeries and appointments. Medical staff had to resort to paper charts and manual processes, affecting the delivery of care to thousands of young patients.
The attack also compromised patient records and forced the hospital to divert some emergency cases to other facilities.
Cost: The hospital refused to pay the ransom but was undoubtedly an expensive affair, with multiple lawsuits filed and weeks of disruption. Hackers claim they sold the data online for $3.4 million.
10. Halliburton
When: August 2024
What happened: The global energy services provider suffered a ransomware attack that forced them to shut down critical IT infrastructure and disconnect client systems.
The incident affected operations across their network, which spans 70 countries and employs 48,000 people. While the company maintained most operations, they experienced delays, disruptions in service delivery, and stolen company data.
Cost: The company reported $35 million in losses from delayed revenue and incident response, including a $0.02 per share impact on their adjusted earnings.
Protect Your Organization in 2025 and Beyond
In 2025, businesses need to ensure they are prepared for the increasing complexity and sophistication of cyber threats.
ProLion provides critical protection at the storage level. By identifying and mitigating threats before they escalate, ProLion safeguards vital business data, ensuring a vital last line of defense often missed in conventional cybersecurity strategies.
Is your organization ready for 2025? Learn more about ransomware protection now or take our cyber resilience assessment to see how well-prepared you are.
