This question is quite broad by specifying a sudden fall to cryptanalysis and therefore my answer might not be as complete as you wish it to be.
If by "become practically attackable, or close enough that use is strongly discouraged" you imply not an academic breach but assume a weaker attacker such as a single ciphertext attack, then there are quite a few ciphers that satisfies this condition. Under this assumption, modern block-ciphers are mainly vulnerable to brute force attack. Should the key length of DES be longer so we would not be able to do an exhaustive search then it would still retain a certain level of security (while its use still be strongly discouraged).
Moving to strongly used block ciphers, here are a few that have been academically broken or weakened to be considered as insecure.
FEAL (Block Cipher)
The first block-cipher that came to my mind with such characteristic is FEAL. It was design in 1987 and aimed to replace the DES by providing fast encryption capacities for 8-bit platforms. It was not widely used and (un)fortunately it was broken even before becoming a new standard in 1990.
Should you teach or would like to practice cryptanalysis, I would recommend breaking FEAL-4 (as 4 rounds) or FEAL-8. It is a great learning exercise.
Some resources :
DES (Block Cipher)
DES is another example. Broken by differential cryptanalysis in 1990 by Eli Biham and Adi Shamir.
In this paper we develop a new type of cryptanalytic attack which can break the reduced variant of DES with 8 rounds in a few minutes on a PC and can break any reduced variant of DES (with up to 15 rounds) in less than $2^{56}$ operations.
from their paper : Differential Cryptanalysis of DES-like Cryptosystems. I really recommend reading this article or at least the extended abstract.
Remark: To break the 16 rounds, one would need $2^{57}$ pairs. The number of cipher texts needed is twice the number of pairs.
On these pairs, only $2^5$ would be used (excluding the wrong pairs that can be easily discarded during the collection phase). Using 15 different characteristics with a probability of $2^{-56}$, 18 bits of the key could be found. Therefore this attack involves slightly more work than a brute-force attack. (Thx Jerry for pointing this out).
3 years later, Mitsuru Matsui introduced a new method to break DES.
As a result it is possible to break a 8-round DES cipher with $2^{21}$ known-plaintexts and 16-round DES cipher with $2^{47}$ known-plaintexts, respectively. Moreover this method is applicable to an only-ciphertext attack in certain situations
from his paper: Linear Cryptanalysis Method for DES Cipher (another good reading).
A5/1 (Stream cipher)
Moving to stream cipher we have A5/1 which is responsible of the privacy of the communication between GSM and the antenna. Developed in 1987, with a key length of $64$ bits. In 1997, Golic presented an attack based on solving sets of linear equations which has a time complexity of $2^{40.16}$.
In 2000 Eli Biham and Orr Dunkelman published an attack with a total work complexity of $2^{39.91}$ A5/1 clockings given $2^{20.8}$ bits of known plaintext. The attack requires 32 GB of data storage after a precomputation stage of $2^{38}$.
Remark: while A5/1 is completely broken (cf Snowden leaked files) it is still in use in our cell phones...
Some resources:
RC4 (Stream cipher)
RC4 (as Rivest Cipher 4) is a stream cipher mainly used in SSL (1995), TLS (1999), WEP (1997) and WPA (2003/2004). It was designed in 1987 but the code was unknown until being leaked in September 1994 (security by obscurity, here I am...)
Some resources:
MD5 (hash function)
Infamous hash function, designed in 1991. Five years later, Dobbertin announced a collision of the compression function of MD5.
In 2009, the complexity of the attack was in $2^{39}$ (initial pre-image complexity is $2^{128}$.
SHA-0 (hash function)
Published in 1993, revised a few years later due to a significant flaw as SHA-1.
At CRYPTO 98, a first collision was found in $2^{61}$ (initial complexity in $2^{80}$.
In February 2005, an attack by Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu was announced which could find collisions in SHA-0 in $2^{39}$ operations. Another attack in 2008 applying the boomerang attack brought the complexity of finding collisions down to $2^{33.6}$.
SHA-1 (hash function)
Published in 1995 as a revision of SHA-0 (see above), it has been first weakened with attacks of complexities:
- $2^{69}$ hashes, per Xiaoyun Wang, Yiqun Lisa Yin, Hongbo Yu: Finding Collisions in the Full SHA-1, in proccedings of Crypto 2005),
- $2^{63}$ hashes, per Xiaoyun Wang, Andrew C Yao, Frances Yao: Cryptanalysis on SHA-1, rump session of Crypto 2005; see also Martin Cochran: Notes on the Wang et al. $2^{63}$ SHA-1 Differential Path, in IACR eprint archives, 2007),
- $2^{61}$ hashes, per Marc Stevens: New collision attacks on SHA-1 based on optimal joint local-collision analysis (in proceedings of Eurocrypt 2013, also freely available from the author's website).
$2^{57.5}$ call of the compression function, per Marc Stevens, Pierre Karpman and Thomas Peyrin: Freestart collision for full SHA-1, 2015.
Until finally The first collision for full SHA-1 was found by Marc Stevens, Elie Bursztein, Pierre Karpman, Ange Albertini, Yarik Markov and published at CRYPTO 2017 (Best Paper Award) with $2^{63}$ calls to the compression function.
I'm probably missing a lot of other block ciphers, but these are the ones mainly known to my knowledge.
