Serge Vaudenay
Cryptographer at EPFL who showed in 2002 that CBC encryption with padding can be broken through error messages.
In "Security Flaws Induced by CBC Padding", published at Eurocrypt 2002, Vaudenay described the padding oracle attack. The insight was that a system which reveals whether padding is valid is enough for an attacker to read the plaintext, even without the key.
It is a reminder that security depends as much on what a system tells the outside world when something fails as on the cipher itself. Several TLS implementations and web frameworks have been caught out since.