The Observer and The New York Times published within hours of each other on 17 March 2018, carrying an account given by Christopher Wylie, who had been Cambridge Analytica's director of research and who had spent months persuading reporters that what he had helped build was worth their attention. The mechanism he described was mundane, which is why it mattered. A University of Cambridge psychologist, Aleksandr Kogan, had put a personality quiz called thisisyourdigitallife on the Facebook platform through his company Global Science Research; roughly 270,000 people installed it, by Facebook's own count; and the permissions of the day allowed the app to read not only their profiles but those of everyone on their friends lists. Early reporting put the harvest at more than 50 million profiles.
Facebook had moved first, suspending Cambridge Analytica, its parent SCL Group, Kogan and Wylie from the platform on 16 March, the evening before publication. Its own announcement is the most damaging document in the file. The company said it had learned in 2015 that Kogan had passed the data to SCL and Cambridge Analytica in violation of platform policy, that it had demanded the data be destroyed, and that Cambridge Analytica, Kogan and Wylie had each certified that they had done so. It did not verify the certifications. It did not tell the people whose profiles had been taken. For three years the matter sat closed on the strength of a signature, which is why this archive is careful with the word breach here: nothing was broken into, and Facebook's deputy general counsel, Paul Grewal, said flatly that the claim this was a data breach was "completely false."
What followed was ten days of an intensity the industry had not seen applied to a privacy story. Channel 4 News broadcast undercover footage of Cambridge Analytica executives on 19 and 20 March, and the company suspended its chief executive, Alexander Nix. Cambridge Analytica denied wrongdoing throughout, saying it had deleted the Kogan data when Facebook asked for it and had not used any of it in the 2016 presidential campaign. Mark Zuckerberg broke five days of silence on 21 March with a statement describing "a major breach of trust." On the evening of 23 March a High Court judge granted the Information Commissioner's Office a warrant; eighteen enforcement officers entered the firm's central London offices at eight o'clock and left around three the following morning. The Federal Trade Commission confirmed on 26 March that it was examining Facebook's privacy practices, and more than $100 billion came off the company's market value — a valuation figure, not lost revenue.
The endings are on the record. Facebook published its own estimate on 4 April, putting the number at up to 87 million people, most of them in the United States; that figure came from the company, not from the reporting. Cambridge Analytica and SCL Elections commenced insolvency proceedings in the United Kingdom on 2 May and ceased operations the same day, with a Chapter 7 bankruptcy filing for its American affiliates following in New York on 17 May, blaming media coverage for driving away its customers. The Information Commissioner's Office issued a £500,000 penalty in October 2018 — the maximum available under the Data Protection Act 1998, the law then in force — which Facebook appealed and later agreed to pay without admitting liability. The Federal Trade Commission's $5 billion penalty followed in July 2019.
Atlanta chose to rebuild
Atlanta recognised the attack on the morning of 22 March 2018. The strain was SamSam, deployed through brute-forced remote access, not a phishing click, and the effect was a city on paper: officers wrote incident reports by hand, the municipal court rescheduled cases it could not look up, residents could not pay water bills or parking tickets, and the Wi-Fi at Hartsfield–Jackson went down. Staff were told not to switch their computers on until 27 March. The ransom note became public because an employee gave a screenshot to a local television station: roughly $6,800 per machine, about $51,000 for the lot, in bitcoin, with a 28 March deadline. Atlanta did not pay. Around $2.7 million in emergency contracts went out within weeks; a confidential report obtained in August by the Atlanta Journal-Constitution and Channel 2 Action News put the projected bill at up to $17 million — a forecast, not an audit. A January city audit had already counted 1,500 to 2,000 vulnerabilities, ten months after WannaCry. The Justice Department indicted two Iranian nationals over SamSam in November 2018; the charges remain allegations and neither man has been arrested.
MyFitnessPal, and the case for bcrypt
Under Armour said on 29 March 2018 that an unauthorised party had acquired data associated with about 150 million MyFitnessPal accounts. Three dates are worth separating: the company placed the acquisition in late February, said its team became aware of it on 25 March, and notified users four days after that — a gap that would have failed the seventy-two-hour rule the General Data Protection Regulation imposed eight weeks later. What was taken was usernames, email addresses and hashed passwords. What was not taken, the company said, was payment card data or government-issued identifiers. The detail that made it a teaching case was the hashing: Under Armour disclosed that the majority of passwords were protected with bcrypt while some used the weaker SHA-1, a distinction most breach notices of the period did not bother to draw, and the one that decided how much of the set was worth cracking. Have I Been Pwned later catalogued 144 million unique addresses from it, and the data surfaced in a bundle offered for sale on a darknet market in February 2019. Under Armour sold MyFitnessPal to Francisco Partners in December 2020.
The court, the gas company and the denial
On 13 March 2018 a five-judge constitution bench of the Supreme Court — Chief Justice Dipak Misra sitting with Justices A K Sikri, A M Khanwilkar, D Y Chandrachud and Ashok Bhushan — extended the 31 March deadline for linking Aadhaar to bank accounts and mobile connections until it ruled on the constitutional challenge. The extension carried an exception: it did not apply to subsidies and benefits under Section 7 of the Aadhaar Act, so the people least able to opt out stayed bound to the system while everyone else was granted time. The hearing became one of the longest in the court's recent history, conducted against a background of leak reports it was not designed to adjudicate.
Ten days later, on 23 March, ZDNet reported that the researcher Karan Saini had found an endpoint on a system run by a state-owned utility that ZDNet declined to name at the time — identified in later reporting as Indane, the liquefied petroleum gas distributor owned by state-run Indian Oil — that returned an Aadhaar holder's name, twelve-digit number and details of linked services, including bank information, with no access controls at all. Saini said he had tried to report the lapse through official channels without it being fixed. The Unique Identification Authority of India answered with a flat denial, saying there had been "absolutely no breach of UIDAI's Aadhaar database." That was accurate and beside the point: the exposure sat in a third party's integration rather than in the central repository, and the argument over whether that distinction protects anyone has run through Indian security ever since. In January the same authority had answered a Tribune investigation, which reported correspondents buying access to the database for ₹500, by filing a criminal complaint.
Six seconds in Tempe
Elaine Herzberg was walking her bicycle across a four-lane road in Tempe, Arizona, late on 18 March 2018 when an Uber test vehicle under computer control struck her; she died of her injuries. The National Transportation Safety Board later set out the sequence: the system registered her roughly six seconds before impact, then classified her as an unknown object, as a vehicle and as a bicycle, revising its prediction of her path each time; at 1.3 seconds it determined that emergency braking was needed. That manoeuvre was disabled whenever the software was driving, as was the Volvo's factory automatic braking, to prevent erratic behaviour; the fallback was the person in the driver's seat. Uber suspended testing the following day, Arizona withdrew its permit on 26 March, and Nvidia opened its developer conference on 27 March with a two-petaflop training machine and word that it too had paused road tests. Google's Project Maven work for the Pentagon had surfaced on 6 March; the revolt it set off ended in a dropped contract and a published set of AI principles.
Slingshot, and who it belonged to
On 9 March 2018 Kaspersky Lab disclosed Slingshot, an espionage operation active since 2012 or earlier that had reached at least a hundred victims across the Middle East and Africa through compromised MikroTik routers, with components that ran in kernel mode. Ten days later CyberScoop reported, citing current and former American intelligence officials, that Slingshot was a Joint Special Operations Command programme aimed at Islamic State and al-Qaeda targets using internet cafés, and that the disclosure had burned its infrastructure. Kaspersky did not confirm the attribution; Eugene Kaspersky argued that an X-ray rings on any gun, whoever is carrying it. The company was already barred from American federal networks; Washington prohibited its products outright in 2024. The month's quieter lesson: on 6 March behaviour monitoring and machine learning in Windows Defender stopped a Dofoil coin-mining campaign, blocking more than 400,000 instances within twelve hours by Microsoft's count, some three-quarters of them in Russia. The vector, disclosed a week later, was a poisoned update to a file-sharing client; the machine-learning detection that stopped it has since become the industry's baseline.
⏳ Time capsule — March 2018
- Sergei Skripal and his daughter Yulia were found unconscious on a bench in Salisbury on 4 March, poisoned with the nerve agent Novichok; Britain expelled 23 Russian diplomats in response.
- Stephen Hawking died at his home in Cambridge on 14 March, aged 76.
- An Uber test vehicle running in autonomous mode struck and killed Elaine Herzberg in Tempe, Arizona, on 18 March — the first recorded pedestrian death involving a self-driving car.
- Cameron Bancroft was filmed using sandpaper on the ball at Newlands on 24 March; Cricket Australia suspended captain Steve Smith and vice-captain David Warner.
The month the terms changed
Ten weeks after the Observer's story, on 25 May 2018, the General Data Protection Regulation became applicable across the European Union, and a compliance deadline that much of the industry had treated as a European inconvenience arrived instead as the first serious answer to the question March had asked. The comparison is the clearest measure in this archive of how far enforcement had fallen behind the thing it was enforcing against: the Information Commissioner's Office could fine Facebook no more than £500,000 for conduct spanning years, because that was the ceiling written into a statute from 1998, while the regulation replacing it was calibrated against global turnover. Zuckerberg testified before Congress in April. Cambridge Analytica was gone by May.
The other threads run forward into editions this archive already holds. Facebook's developer platform surfaced again in April 2019, when 540 million records originating with app developers were found sitting in open cloud storage — the same architecture, a different failure. Atlanta became the template for the municipal ransomware years that follow in these pages, and the pattern it set, of refusing the demand and paying many times the demand to rebuild, is now the ordinary shape of the decision. MyFitnessPal's bcrypt remains the plainest argument this archive can make for spending money on password storage. In India the Supreme Court upheld Aadhaar on 26 September 2018 while striking down Section 57; the law to govern any of it took until August 2023.