A5/1
The stream cipher that protected GSM calls in Europe — secret from 1987 until it leaked, and broken in practice in 2009.
It was designed in 1987 for GSM and kept secret, on the old theory that secrecy makes things safer. The design leaked in the mid-1990s and was fully reconstructed by 1999. It uses three linear feedback shift registers clocked irregularly, driven by a 64-bit session key. The export variant A5/2 was deliberately weaker and fell even faster.
Academic attacks appeared early, but in 2009 Karsten Nohl and colleagues released rainbow tables that made interception feasible on hobbyist hardware. Operators moved to A5/3, based on KASUMI, yet many networks kept negotiating down to A5/1 for old handsets for years. A textbook case for why Kerckhoffs's principle exists.