Personal identifying information for 1.5 billion users was stolen in 2021, but from where?

Menace intelligence firm Black Kite discovered that almost all of assaults have been towards healthcare suppliers, concerned ransomware and succeeded because of software program vulnerabilities.

cyber attack, data breach

Rawpixel, Getty Photos/iStockphoto

It was a giant yr for cybercriminals, who made off with someplace within the neighborhood of $1.5 billion value of customers’ private figuring out info (PII) in 2021, in accordance with a report from risk intelligence firm Black Kite.

Black Kite checked out 81 third-party breaches that accounted for over 200 public disclosures, and its high findings are unsurprising for anybody who lived by the previous yr: Ransomware assaults have been the commonest, healthcare suppliers have been the most well-liked goal, and attackers largely exploited software program vulnerabilities to perform their targets. 

SEE: Password breach: Why popular culture and passwords do not combine (free PDF) (TechRepublic)

Bob Maley, chief safety officer at Black Kite, stated that the developments it recognized within the report present that risk actors, like many corporations, have gotten extra agile and able to launching fast, devastating assaults. 

“[Increased attacker agility] is not only a change from 2021, however an general message. Assault strategies have gotten extra intelligent, extra detailed, with flexibility and dexterity. If agile assault strategies are enhancing, our response should match, if not counter their development,” Maley stated within the report. 

2021: A portrait in breach stories

Black Kite stated that ransomware breaches solely accounted for 15% of assaults in 2020, in contrast with 27% in 2021. The report calls ransomware “essentially the most environment friendly assault technique,” describing it as one of many quickest and best methods to steal, after which monetize, information like consumer PII. 

Except for ransomware, unauthorized community entry and unsecured servers/databases have been the 2 different high breach strategies in 2021. The report describes the 2 strategies as primarily consisting of cracking weak passwords or vulnerabilities in entry management within the case of the previous, and unsecured internet-facing {hardware} and software program within the case of the latter. 

When it comes to third-party distributors that have been essentially the most breached, software program publishers beat out IT service suppliers, healthcare tech suppliers, admin companies and cybersecurity suppliers for the third yr in a row. 

“Most of the time, corporations belief that the software program and companies they use are safe and don’t examine for vulnerabilities alongside the digital provide chain. Exploitations of weaknesses alongside the provision chain have led to a number of the most notable assaults over the previous couple of years, together with 2020’s SolarWinds (assault),” the report stated.

As for industries being focused, healthcare leads for no different purpose than the COVID-19 pandemic, which has thrust healthcare into unsafe territory. “Lack of price range, remotely shared private information between sufferers and hospital methods, and outdated software program all level to avenues for hackers to infiltrate and acquire entry to an organization’s information,” the report stated. 

Closing the hole between attacker and goal

The report stated that it discovered healthcare and authorities companies to be the most probably to have improved their safety postures prior to now yr, largely as a result of they have been making an attempt to stop one other assault. It is a optimistic end result, however the report additionally calls on readers to think about how a lot smaller the impression of an assault would have been had these steps been taken earlier.

“There are gaps proper now in vendor threat administration and the best way company society approaches cyber posture as an entire. If the method stays compliance- and checklist-oriented, we forfeit agility for rule-following,” Maley stated. 

SEE: Google Chrome: Safety and UI ideas you’ll want to know (TechRepublic Premium)

As a substitute of pondering of issues by way of compliance, Maley stated safety must be considered by way of consciousness. “A mature vendor risk-management program means taking a look at 200+ locations directly in an effort to slowly shut the gaps,” Maley stated. 

What that appears like in observe is real-time insights offered by specialised instruments that join throughout ecosystems to place all the things you’ll want to know in a single place.

“If you’ll take one studying away from this, keep in mind that merely following greatest practices, checklists and assembly trade requirements is outdated methodology for understanding threat. Managing threat with the massive image in thoughts is not qualitative, it’s versatile. Agility is all about understanding the place to look, and actually trying is not process-based,” Maley stated.

Additionally see

Recent Articles


Related Stories

Leave A Reply

Please enter your comment!
Please enter your name here

Stay on op - Ge the daily news in your inbox