Tag: evergreens

Open source companies that go proprietary: A timeline

Posted on by faz_business


Open source might be the building blocks of the modern software stack, but companies building businesses off the back of open source software face a perennial struggle between keeping their community happy and ensuring that third parties don’t abuse the permissions afforded by the license.

Many companies have launched with lofty open source ambitions, only to duck for cover once the realities of the commercial world hit home. It’s all about protecting their bottom line, especially with investors (public or private) to appease.

But it can be difficult keeping tabs on all these changes, while also distinguishing those that have abandoned open source altogether and those that have sought sanctuary behind a less permissive (but still open source) license (as the likes of Element and Grafana have done in the past few years).

As such, TechCrunch has compiled a timeline of open source companies that have changed course over the past decade.

Movable Type (2013)

Movable Type created an open source version (called MTOS) of its web publishing software in 2007 under a “copyleft” GPL open source license, a move that positioned it more closely to WordPress. Such licenses afford certain freedoms, but stipulate that all derivative work be released under a similar license. At any rate, this move lasted until 2013, at which point Movable Type’s then owners ditched the open source product, opining that it “hurt the adoption” of the commercial versions.

“The community has not grown because of MTOS, nor have we seen download numbers that are any greater than our paid versions of Movable Type, so at this point it does not make any economic sense to continue to maintain and distribute something that is getting very little use,” the company wrote at the time.

SugarCRM (2014)

Founded initially in 2004, customer relationship management (CRM) software maker SugarCRM announced in 2014 that it would no longer provide an open source “community edition,” noting that its two core markets — developers and first-time CRM users seeking a cheap solution — were not effectively being served by the product.

The company did continue to support the last version (v6.5) of the open source incarnation for four more years, before pulling the plug in 2018.

Redis (2018)

Redis, creators of the popular in-memory database store, has been transitioning away from its open source roots since 2018, when it moved its “Redis Modules” (e.g. RediSearch) from an open source AGPL license to Apache 2.0 with a “Commons Clause” addendum (i.e. commercial restrictions). The following year, Redis replaced the Commons Clause with its own Redis Source Available License (RSAL) that promised to maintain some freedoms, but with notable restrictions related to competing database services — such as those provided by companies such as AWS.

In many ways, this was a bellwether of what was to come, as other companies would later cite the “Amazon problem” as their reason for switching their license up. Earlier this year, Redis’ transition to the world of proprietary was complete, when it announced that its core software would be shifting from a BSD 3-Clause license to a dual-license setup — RSAL or server side public license (SSPL).

MongoDB (2018)

In 2018, database company MongoDB moved away from an open source AGPL license to SSPL. The reason? Yup: to prevent cloud hyperscalers such as AWS from selling their own version of the service without contributing back.

Confluent (2018)

The “year that was” for open source license switching concluded with Confluent, a company that sells enterprise-grade tools and services around Apache Kafka, switching some of the components of its core platform from Apache 2.0 to a proprietary Confluent Community License.

This license stipulates a notable exclusion, one that forbids any competing service from offering Confluent’s wares “as-a-service.”

Cockroach Labs (2019)

Cockroach Labs, creator of the eponymous distributed SQL database known as CockroachDB, has continued to shake up its licensing ethos.

In 2019, the company’s founders announced that they were moving CockroachDB from the permissive Apache 2.0 license to the Business Source License (BUSL). Again, cloud hyperscalers such as AWS were the driving force behind the change.

“We’re witnessing the rise of highly integrated providers take advantage of their unique position to offer ‘as-a-service’ versions of OSS [open source software] products, and offer a superior user experience as a consequence of their integrations,” the founders wrote at the time.

Back in August, Cockroach Labs announced yet another change: It would consolidate its self-hosted product under a single enterprise license, as a way to encourage larger businesses to pay for the features they really need. 

Sentry (2019)

Sentry, the $3 billion company behind the app performance monitoring platform of the same name, was once available under a permissive BSD 3-Clause open source license. But in 2019, the company moved to BUSL, with co-founder and CTO David Cramer saying this was to counter “funded businesses plagiarizing or copying our work to directly compete with Sentry.”

Last year, Sentry launched its very own Functional Source License (FSL), which is similar to BUSL but a little simpler. And as of this year, Sentry is putting its weight behind a new licensing paradigm dubbed “fair source,” which, as TechCrunch reported at the time, is “designed to bridge the open and proprietary worlds, replete with new definition, terminology, and governance model.”

Elastic (2021)

It was several years in the making, but Elastic — creator of enterprise search engine Elasticsearch and the Kibana visualization dashboard — went proprietary in 2021. It was a familiar story, one that can be traced back to 2015 when AWS launched its own managed Elasticsearch service.

However, Elastic stands somewhat alone as one of the only companies to move away from open source, and then move back. Back in August, Elastic announced it would be adopting an AGPL license — different to the Apache 2.0 license it used prior to 2021, but open source nonetheless.

HashiCorp (2023)

HashiCorp also abandoned the open source ship last year, announcing that it was switching its popular “infrastructure as code” tool Terraform from a copyleft open source license to BUSL.

The familiar reason was to prevent certain vendors from monetizing Terraform without contributing anything back to the project.

An open source fork called OpenTofu was launched earlier this year by third parties, and as a notable aside, IBM snapped up HashiCorp for $6.4 billion.

Snowplow (2024)

Snowplow, a VC-backed platform that helps companies collect behavioral data for AI applications, this year switched from an open source Apache 2.0 license to the Snowplow Limited Use License Agreement.

The reason, the company said, was that it needs to fund its “exciting technology roadmap,” and thus everyone running its software in production should “pay for the value they receive in return.” The new license also explicitly prevents users from creating a competitive product built on top of Snowplow.

The biggest data breaches in 2024: 1 billion stolen records and rising

Posted on by faz_business


We’re almost at the end of 2024, a year that will go down as having seen some of the biggest, most damaging data breaches in recent history. And just when you think that some of these hacks can’t get any worse, they do.

From huge stores of customers’ personal information getting scraped, stolen and posted online, to reams of medical data covering most people in the United States getting stolen, the worst data breaches of 2024 have surpassed the 1 billion stolen records and rising. These breaches not only affect the individuals whose data was irretrievably exposed, but also embolden the criminals who profit from their malicious cyberattacks.

Travel with us to the not-so-distant past to look at how some of the biggest security incidents of 2024 went down, their impact and, in some cases, how they could have been stopped. 

AT&T’s data breaches affect “nearly all” of its customers, and many more non-customers

For AT&T, 2024 has been a very bad year for data security. The telecoms giant confirmed not one, but two separate data breaches just months apart.

In July, AT&T said cybercriminals had stolen a cache of data that contained phone numbers and call records of “nearly all” of its customers, or around 110 million people, over a six-month period in 2022 and in some cases longer. The data wasn’t stolen directly from AT&T’s systems, but from an account it had with data giant Snowflake (more on that later).

Although the stolen AT&T data isn’t public (and one report suggests AT&T paid a ransom for the hackers to delete the stolen data) and the data itself does not contain the contents of calls or text messages, the “metadata” still reveals who called who and when, and in some cases the data can be used to infer approximate locations. Worse, the data includes phone numbers of non-customers who were called by AT&T customers during that time. That data becoming public could be dangerous for higher-risk individuals, such as domestic abuse survivors.

That was AT&T’s second data breach this year. Earlier in March, a data breach broker dumped online a full cache of 73 million customer records to a known cybercrime forum for anyone to see, some three years after a much smaller sample was teased online.

The published data included customers’ personal information, including names, phone numbers and postal addresses, with some customers confirming their data was accurate. 

But it wasn’t until a security researcher discovered that the exposed data contained encrypted passcodes used for accessing a customer’s AT&T account that the telecoms giant took action. The security researcher told TechCrunch at the time that the encrypted passcodes could be easily unscrambled, putting some 7.6 million existing AT&T customer accounts at risk of hijacks. AT&T force-reset its customers’ account passcodes after TechCrunch alerted the company to the researcher’s findings. 

One big mystery remains: AT&T still doesn’t know how the data leaked or where it came from. 

Change Healthcare hackers stole medical data on “substantial proportion” of people in America

In 2022, the U.S. Justice Department sued health insurance giant UnitedHealth Group to block its attempted acquisition of health tech giant Change Healthcare, fearing that the deal would give the healthcare conglomerate broad access to about “half of all Americans’ health insurance claims” each year. The bid to block the deal ultimately failed. Then, two years later, something far worse happened: Change Healthcare was hacked by a prolific ransomware gang; its almighty banks of sensitive health data were stolen because one of the company’s critical systems was not protected with multi-factor authentication.

The lengthy downtime caused by the cyberattack dragged on for weeks, causing widespread outages at hospitals, pharmacies and healthcare practices across the United States. But the aftermath of the data breach has yet to be fully realized, though the consequences for those affected are likely to be irreversible. UnitedHealth says the stolen data — which it paid the hackers to obtain a copy — includes the personal, medical and billing information on a “substantial proportion” of people in the United States. 

UnitedHealth has yet to attach a number to how many individuals were affected by the breach. The health giant’s chief executive, Andrew Witty, told lawmakers that the breach may affect around one-third of Americans, and potentially more. For now, it’s a question of just how many hundreds of millions of people in the U.S. are affected. 

Synnovis ransomware attack sparked widespread outages at hospitals across London 

A June cyberattack on U.K. pathology lab Synnovis — a blood and tissue testing lab for hospitals and health services across the U.K. capital — caused ongoing widespread disruption to patient services for weeks. The local National Health Service trusts that rely on the lab postponed thousands of operations and procedures following the hack, prompting the declaration of a critical incident across the U.K. health sector.

A Russia-based ransomware gang was blamed for the cyberattack, which saw the theft of data related to some 300 million patient interactions dating back a “significant number” of years. Much like the data breach at Change Healthcare, the ramifications for those affected are likely to be significant and life-lasting. 

Some of the data was already published online in an effort to extort the lab into paying a ransom. Synnovis reportedly refused to pay the hackers’ $50 million ransom, preventing the gang from profiting from the hack but leaving the U.K. government scrambling for a plan in case the hackers posted millions of health records online. 

One of the NHS trusts that runs five hospitals across London affected by the outages reportedly failed to meet the data security standards as required by the U.K. health service in the years that ran up to the June cyberattack on Synnovis.

Ticketmaster had an alleged 560 million records stolen in the Snowflake hack

A series of data thefts from cloud data giant Snowflake quickly snowballed into one of the biggest breaches of the year, thanks to the vast amounts of data stolen from its corporate customers. 

Cybercriminals swiped hundreds of millions of customer data from some of the world’s biggest companies — including an alleged 560 million records from Ticketmaster, 79 million records from Advance Auto Parts and some 30 million records from TEG — by using stolen credentials of data engineers with access to their employer’s Snowflake environments. For its part, Snowflake does not require (or enforce) its customers to use the security feature, which protects against intrusions that rely on stolen or reused passwords. 

Incident response firm Mandiant said around 165 Snowflake customers had data stolen from their accounts, in some cases a “significant volume of customer data.” Only a handful of the 165 companies have so far confirmed their environments were compromised, which also includes tens of thousands of employee records from Neiman Marcus and Santander Bank, and millions of records of students at Los Angeles Unified School District. Expect many Snowflake customers to come forward. 

(Dis)honorable mentions

Cencora notifies over a million and counting that it lost their data:

U.S. pharma giant Cencora disclosed a February data breach involving the compromise of patients’ health data, information that Cencora obtained through its partnerships with drug makers. Cencora has steadfastly refused to say how many people are affected, but a count by TechCrunch shows well over a million people have been notified so far. Cencora says it’s served more than 18 million patients to date. 

MediSecure data breach affects half of Australia:

Close to 13 million people in Australia — roughly half of the country’s population — had personal and health data stolen in a ransomware attack on prescriptions provider MediSecure in April. MediSecure, which distributed prescriptions for most Australians until late 2023, declared insolvency soon after the mass theft of customer data.

Kaiser shared health data on millions of patients with advertisers:

U.S. health insurance giant Kaiser disclosed a data breach in April after inadvertently sharing the private health information of 13.4 million patients, specifically website search terms about diagnoses and medications, with tech companies and advertisers. Kaiser said it used their tracking code for website analytics. The health insurance provider disclosed the incident in the wake of several  other telehealth startups, like Cerebral, Monument and Tempest, admitting they too shared data with advertisers.

USPS shared postal address with tech giants, too:

And then it was the turn of the U.S. Postal Service caught sharing postal addresses of logged-in users with advertisers like Meta, LinkedIn and Snap, using a similar tracking code provided by the companies. USPS removed the tracking code from its website after TechCrunch notified the postal service in July of the improper data sharing, but the agency wouldn’t say how many individuals had data collected. USPS has over 62 million Informed Delivery users as of March 2024.

Evolve Bank data breach affected fintech and startup customers:

A ransomware attack targeting Evolve Bank saw the personal information of more than 7.6 million people stolen by cybercriminals in July. Evolve is a banking-as-a-service giant serving mostly fintech companies and startups, like Affirm and Mercury. As a result, many of the individuals notified of the data breach had never heard of Evolve Bank, let alone have a relationship with the firm, prior to its cyberattack.

National Public Data goes broke after millions of SSNs stolen

The company behind the data broker National Public Data filed for Chapter 11 bankruptcy protection in October, months after a massive data breach exposed some three billion records affecting around 270 million individuals, according to various analyses by security researchers. The data broker allowed its paying customers access to its vast databases of names, dates of birth, email and postal addresses, phone numbers, and Social Security numbers (even if not all of the data was accurate). The company said it had to file for bankruptcy as it can no longer generate the revenue to address the deluge of class-action lawsuits and mounting liability from state and federal regulators.

First published on June 28 and updated on October 14.