SHAttered
The first public SHA-1 collision: two different PDF files with the same hash, unveiled by Google and CWI Amsterdam in February 2017.
Theoretical attacks on SHA-1 had existed since 2005, but nobody had produced an actual collision. Marc Stevens and colleagues at CWI, together with Google's security team, did it with about 9.2 quintillion SHA-1 computations — the equivalent of 6,500 CPU-years and 110 GPU-years. The result: two PDFs that looked different and hashed identically.
It was an identical-prefix collision, harder to weaponise than the chosen-prefix collision that followed in 2020 ("SHA-1 is a Shambles"). It was enough regardless: browsers had already stopped trusting SHA-1 certificates, and Git added collision detection and began its long migration to SHA-256.