More details have emerged about the cyberattack that hit Disney earlier this summer, one of the largest corporate data breaches in recent years. A hacker group known as Nullbulge leaked over 1.1 terabytes of sensitive data, including internal financial details, personal information about employees and customers, and login credentials to cloud systems. The breach, which exposed vast information, highlights significant cybersecurity vulnerabilities even in large corporations with vast resources, such as Disney.

Documents reviewed by The Wall Street Journal show that the leaked data includes internal financial figures, detailed Slack communications, and confidential information about Disney’s theme park strategies and streaming services. The leak sheds light on Disney’s operations and raises important questions about the adequacy of corporate cybersecurity measures and insider threat management.

Critical Financial Information Exposed

Among the most significant revelations in the breach are the financial details regarding two of Disney’s major revenue streams: Disney+ and the Genie+ premium park pass. Internal documents showed that Disney+ generated over $2.4 billion in revenue during the first quarter of 2024, making up approximately 43% of the company’s direct-to-consumer revenue. This granular level of detail is rarely disclosed in Disney’s public financial filings and offers new insight into the performance of its streaming services.

Another key revenue driver, Disney’s Genie+ park pass system, also saw its internal financials exposed. According to the documents, Genie+ generated over $724 million in pretax revenue between its launch in October 2021 and June 2024 at Walt Disney World alone. “These numbers underscore just how crucial Genie+ and Disney+ have become for the company’s financial health,” said an industry analyst. “Having this data out in the open makes Disney vulnerable to competitive insights.”

Personal Data Compromised

The breach also compromised personal data, including Disney Cruise Line employees’ passport numbers, visa details, and home addresses. This has heightened concerns about identity theft and the broader implications of such sensitive information falling into the wrong hands. A separate spreadsheet contained Disney Cruise passengers’ names, addresses, and contact information, further escalating privacy concerns.

“Data breaches like this are becoming more common, but the scale and sensitivity of this one make it particularly troubling,” said cybersecurity expert Steve Layne, CEO of Insider Risk Management. “When personal details like passport numbers and home addresses are exposed, it creates an immense risk not just for the company but for every individual involved.”

Disney’s response to the breach has been carefully measured. A spokesperson stated, “We decline to comment on unverified information The Wall Street Journal has purportedly obtained as a result of a bad actor’s illegal activity.” Still, Disney assured investors in its August regulatory filing that the breach had not materially impacted its financial performance. However, experts warn that the long-term fallout could be significant.

The Role of Insider Threats in Cybersecurity Failures

One of the most alarming aspects of the breach is how it occurred. Nullbulge claimed they gained access by compromising a single employee’s device—specifically by accessing Slack cookies- allowing them to infiltrate Disney’s internal communications systems. This method highlights the growing importance of mitigating insider threats, which can result from accidental, negligent, or malicious actions.

“Insider threats only come in three forms: accidental, negligent, or malicious human behavior,” Layne explained. “In this case, adversaries targeted a software development manager, which gave them access to a treasure trove of highly confidential data. Companies need to invest more in insider risk programs that could prevent incidents like this from happening.”

Experts in cybersecurity agree that insider threats remain one of the most difficult attack vectors to defend against. Khwaja Shaik, IBM’s CTO and a board advisor on digital transformation, warned that “the question isn’t whether your organization will face a breach, but how prepared you are to respond and protect your most valuable asset: trust.”

Shaik elaborated on the growing sophistication of cyberattacks, noting, “Traditional hacking methods are giving way to more advanced techniques, such as inference attacks, which exploit known data to infer sensitive information without directly infiltrating systems. This makes defending against such breaches incredibly difficult.”

A Call for Stronger Cybersecurity Measures

In the wake of the breach, cybersecurity experts are calling for stronger measures to prevent similar incidents in the future. Dr. Erdal Ozkaya, a renowned cybersecurity strategist, emphasized the importance of endpoint security and network observability in mitigating the risks posed by hackers. “The attack on Disney highlights how crucial it is for companies to invest in robust cybersecurity measures, particularly when it comes to securing endpoints and monitoring network traffic for unusual activity,” Ozkaya said.

He added, “Phishing remains one of the most common entry points for attackers, and training employees to recognize these attacks is critical. But beyond training, companies need to implement systems that can detect and prevent unauthorized access in real time.”

Insider risk programs have become increasingly popular among companies looking to protect themselves from these types of attacks. “Organizations often underestimate the importance of having a robust risk management framework that quantifies the probability and impact of insider threats,” said Tim Burr, a leading IT executive. “Without that, it’s difficult to show a return on investment for cybersecurity programs aimed at preventing insider breaches.”

The Growing Role of Hacktivism

Nullbulge, the group responsible for the Disney hack, claims to be a Russia-based hacktivist group advocating for artist rights. However, security researchers believe the attack may have been carried out by a lone individual based in the United States. In a direct message via X (formerly Twitter) in July, Nullbulge claimed they accessed Disney’s data through a compromised device belonging to a software development manager.

“Whether this was the work of a group or an individual, the impact is the same,” Ozkaya said. “Hacktivism has blurred the lines between activism and criminality, with personal data and corporate secrets often becoming collateral damage in their efforts to make a statement.”

As companies increasingly rely on digital communication platforms like Slack, the attack underscores the vulnerabilities that exist within modern workplace systems. Nullbulge’s method of accessing Disney’s systems by exploiting Slack cookies is a stark reminder of how seemingly small weaknesses can lead to massive breaches. “This breach should serve as a wake-up call for any organization using cloud-based communication tools,” Ozkaya emphasized. “Proper encryption, multi-factor authentication, and endpoint security are non-negotiable.”

Long-Term Reputational Costs

While Disney has stated that the breach had no material impact on its financial performance, the long-term consequences may be more significant. The exposure of financial details, personal information, and internal communications not only opens Disney up to reputational damage but also legal challenges, especially if personal data is used maliciously.

“Data breaches aren’t just about short-term financial impact—they have long-term reputational costs, especially for a brand like Disney that relies heavily on consumer trust,” said Ravi Hirolikar, a seasoned CISO and cybersecurity advisor. “The cost of restoring that trust, particularly when personal data is involved, is enormous.”

In the increasingly complex arena of cybersecurity, experts agree that breaches like this are inevitable, but what matters most is how companies respond. Khwaja Shaik noted, “Boards need to view cybersecurity not just as a compliance issue but as a core part of their business strategy. The future of business hinges on the ability to safeguard data and build a culture of trust.”

A Lesson for Enterprise-Level Organizations

The Disney data breach is another wake-up call to enterprise-level organizations that no company is immune from cyberattacks, no matter how large or well-funded. As companies like Disney continue to digitize operations and rely on cloud infrastructure, the importance of robust cybersecurity measures cannot be overstated. The breach also highlights the growing role of insider threats and the need for companies to address these risks proactively.

For Disney, the road ahead will likely involve increased investment in cybersecurity and a renewed focus on protecting both corporate secrets and the personal data of its customers and employees. For the broader corporate world, the breach serves as another reminder to treat data security as not just a technical issue but a critical component of overall business strategy.

As Steve Layne put it, “Imagine the economic cost of this incident and the return on investment of a strong insider risk program that could have prevented it.”