The Heartbleed vulnerability in OpenSSL (CVE-2014-0160) was a critical out-of-bounds read flaw in the Heartbeat Extension, allowing attackers to read up to 64KB of server memory per request without authentication. Exploited via malformed heartbeat packets, it exposed private SSL keys, usernames, passwords, session cookies, and personal data from millions of systems globally, including major websites (e.g., banks, social media, government portals). The breach enabled large-scale surveillance, impersonation, and man-in-the-middle attacks, forcing emergency patches, certificate revocations, and password resets worldwide. While no direct financial theft was publicly confirmed, the reputational damage was severe, eroding trust in encryption standards. Organizations faced compliance violations (e.g., GDPR, PCI-DSS) and costly remediation, including infrastructure audits and legal liabilities. The vulnerability remained undetected for over two years, highlighting systemic failures in code review and testing for memory-safety issues in widely used cryptographic libraries.