As we head towards the end of Cybersecurity Awareness month and into Halloween, we thought we would share some of the scariest cybersecurity stories that have haunted the world of cybersecurity. We examine the consequences of some of the most frightening cyberattacks and how they could have been avoided.
Dare to read on?!
When Health Care Patients Were Made to Cry
In May 2017, evil ransomware called WannaCry cost a Health Service $105m through services lost by the attack as well as IT costs in the aftermath.
The Bloody Aftermath
More than 80 hospitals and doctors' surgeries were also affected after the ransomware locked down 70,000 devices, including computers, MRI scanners, and other theater equipment across hospitals in England.
In February 2018, it was revealed that none of the 200 trusts tested for cybersecurity vulnerabilities passed inspection, meaning they were again left vulnerable to further attacks.
Live and Learn
Hospitals and surgeries were assisted in protecting their networks. These include zero-day vulnerabilities in Microsoft Exchange Server and TCP/IP vulnerabilities discovered in millions of Internet of Things devices. Ensuring correct back-ups for healthcare systems has also become a focal point.
Haunting the Victims of a Cheater’s Dating Site
In 2015, hackers stole 32 million records from one of the world’s leading extramarital affair sites that encouraged users to have ‘discreet encounters’. The hackers gave the company a limited timeline to release both company and customer data, otherwise, their websites would be shut down. Their deadline passed, and the first major data dump took place, exposing and publishing account holders' personal details.
The Bloody Aftermath
Victims of the data breach received emails from the hackers that contained personal and at times, embarrassing details that led to psychological damage and family breakdowns, having an impact on both spouses and children. Bitcoin ransoms of around $1,000 were demanded, with a limited time frame to pay.
Live and Learn
The advantage of sexual email is that it’s even less likely to be reported by the victim due to self-blame and concerns of being exposed publicly.
A security researcher later discovered that the dating site had extremely poor security practices. Security credentials were hardcoded and included database passwords, authentication tokens, API secrets and SSL private keys.
Organizations need to ensure that data is secure and guarantee that only verified users have access to their systems. It has the potential to save an entire organization.
Welcome to the DarkSide
DarkSide was a cybercriminal team that targeted businesses worldwide and brought down one of the most significant US pipeline companies, bringing operations to a standstill for 5 days in 2021.
The Bloody Aftermath
Not only did the breach affect the pipeline and millions of supplies, it also brought the airline industry to a standstill and resulted in a rush of panic buying as well as a spike in gas prices.
A ransom was paid totaling around $5m in bitcoin after managing to steal 100GB of data in a few hours.
Live and Learn
The US pipeline was successfully hijacked by DarkSide's ransomware attack because one of the pipeline’s employees reused a VPN password. After the attackers obtained the password, they were able to log in because multifactor authentication was not enabled, signifying that merely the password was sufficient to successfully breach the entire system.
When Digital Marketplaces Lose Their Magic
A Chinese multinational technology company specializing in e-commerce, retail, Internet, and technology incurred a massive data breach this year (2022). A hacker offered to share information about one billion Chinese citizens and posted a sample of 750,000 records containing personal data.
The Bloody Aftermath
This happened over the course of eight months, when a software developer trawled the site, sneakily scraping user information. It resulted in one of the biggest data breaches in history.
Live and Learn
The breach is believed to have occurred as a result of a misconfigured cloud server that did not require a password to access the data. In turn, data containing names, home locations, ID numbers, phone numbers, and criminal records were exposed.
Following the breach, China vowed to improve the protection of online user data privacy, including using safer data storage solutions.
Sophisticated Yet Purely Evil Supply Chain Attacks
One of the biggest software companies in the USA, which provides system management tools for network and infrastructure monitoring and other technical services to thousands of companies worldwide, triggered one of the largest and most sophisticated supply chain incidents in history.
The Bloody Aftermath
After threat actors gained unauthorized access to the company’s network, updates were sent out by the company that contained hacked code. More than 18,000 customers installed malicious updates, resulting in malware spreading undetected.
Live and Learn
Focus on basics such as understanding users, vendors and assets. Adopt a zero trust policy and work on a "what you don’t know” basis, ensuring visibility across the organization. This includes everything from mobile devices all the way up to cloud and on-premises infrastructure. Understand the relationship between users and devices, including the data that is accessed.
If attackers had to confirm their identity with identity-based authentication, they would not have gotten very far.
Ghosts on a Plane
One of the biggest low-cost airlines became a victim of a cyber attack in which the data of 9 million customers was compromised. This included over 2,000 credit card details with CVV numbers.
The Bloody Aftermath
A lawsuit commenced, resulting in a claim that the airline was in violation of the GDPR Data Protection Act which may result in a loss of the airlines' 4% annual turnover. Credit card fraud increased, resulting in financial loss for some customers following the attack.
Live and Learn
The hacker groups allegedly gained easy access to client information due to poor IT infrastructure on the airline's website. It remains unclear whether financial data was encrypted and how this was compromised.
Incidents like this demonstrate how vital systems of huge corporations can be highly vulnerable and that more work is needed to secure sensitive data, protecting both businesses and individuals alike.
The Cut-throat Conclusion
Protect your organization with Utimaco.
Digital assets are critical components for ensuring the smooth running of any organization. To protect your brand and your bottom line, you must ensure that your digital assets - data, software and systems - are protected and secure from both physical and digital threats. They must be protected from hackers as well as employees.
To reach this balance, the organization, IT, risk, and other functions must collaborate towards a common, enterprise-wide goal.
