A report by research firm Canalys revealed that over 31 billion records were compromised from a variety of data breaches throughout 2020, with an average of 101 million of those lost to victims. This represents an increase in compromised data of 171% from 2019 alone, and makes up more than half of the average of total records lost over the past 15 years combined. A variety of factors have merged to contribute to this final sum, including the work from home shift in response to the COVID-19 pandemic and the surge in ransomware attacks seen over the past year.
More Records Compromised in 2020 Than Most Previous Years Combined
2020 saw a huge surge in both the number of breaches seen and in the amount of data that was compromised in these, which Canalysis noted occurred in spite of a modest increase in cybersecurity spending. However, the firm also pointed out that this growth in security investment was dwarfed in most corporate budgets by more immediate spends. These include items like webcams, new software applications and other upfront purchases that were desperately needed when the pandemic began, but may have obfuscated equally pressing needs in cyber resilience.
85% of Data Breaches Involved Human Element
A similar report by Verizon adds onto some of Canalysis’s findings, and may reinforce their hypothesis on the lack of cybersecurity focus as this study found that most (85%) data breaches included a human element, and 80% were only uncovered by an outside party. This speaks to a level of complacency, ignorance, distraction or any combination of the three that prevented many of the victims from discovering the intrusions that compromised their data. The factors introduced by the COVID-19 pandemic certainly contributed to producing these in many cases as unprepared businesses became overwhelmed by changes in practice, environment and revenue stream.
Healthcare, Finance, Big Tech and More Targeted by Ransomware
The Verizon report also dug into how certain trends impacted global regions more specifically, such as how North America typically sees many more financially motivated attacks against targets in a variety of industries. Many of the latter see a mix of both internal human error and external intrusion attempts that vary in frequency according to their specific sector. Financial services and insurance firms suffer from examples of each, while retail is continuously beset by cybercriminals seeking payment information, which the Canalys study also highlights as having been especially affected by a greater ecommerce shift.
No matter the industry or the cause, it is most often sensitive data that is the biggest target for businesses and organizations in the US, likely following Verizon’s findings as the common trend between the diversity of data sets is the ability to monetize it. The method most widely deployed today to achieve this is to encrypt these files with ransomware, as has been seen in the string of attacks from late 2020 into 2021 affecting a range of companies and institutions.
Suppliers Breached, Multiple Extortions and Other Hacker Tactics
Schools, hospitals, manufacturers and even quite a few Big Tech brands have been hit by data breaches, although a curious case in the latter reveals one of many distributing evolutions of tactics being seen in this cybercrime subsector. In early Q2 2021, the infamous REvil ransomware gang posted a message on the dark web threatening Apple with the release of upcoming product schematics to competitors unless they were paid $50 million by May 1, 2021. This incident has sparked increased interest as the files were supposedly stolen from Apple’s largest manufacturer, Quanta Computer of Taiwan.
This is one of a few new cases of cybercriminals going directly after a third party vendor to hold hostage data they have access to from a much bigger customer. It also reflects a noticeable trend of escalation among cybercriminal groups focusing on ransomware, which includes other emerging techniques like reinfecting and re-extorting the same target, just to reinforce the compulsion for victims to pay. These trends likely arise from a variety of factors that have affected hacker’s ability to successfully gain a ransom, from more stringent regulations and outright sanctions against paying certain criminal groups to increased competition in a rapidly expanding dark web marketplace for malware.
The Pandemic Changed Cybersecurity in 2020
The clear focal point of the Canalys study is that the events of the COVID-19 pandemic completely (and possibly irrevocably) changed the face of cybersecurity for businesses of all sizes. One of the many disruptions 2020 brought was breaking the myth that the right organization could skate by with a limited network presence and basic security controls, as long as they were a small enough blip on the radar. The research consistently proves two points – the first that hackers do not discriminate between targets, and the second that there are many, many channels outside of your control for cybercriminals to gain access to your data, and it is only a matter of time and opportunity.
The cybercrime ecosystem continues to grow exponentially and with each new cyber breach personal information is proliferated across the dark web, changing hands between malicious actors across the entire world. There is no escaping the interconnectivity of modern networks, either, with your employees’ personal devices contributing to a shadow IT infrastructure integrated with your business systems. All it takes for hackers is to find the right combination of credentials for sale (or to steal from other thieves) and begin trying to socially engineer or brute force their way past your minimum layer of protections to capture admin control over your data and applications.
Secure Your Data in 2021, and Prepare Better for 2022
The lessons from 2020 MUST inform your cybersecurity stance for 2021, and help you to prepare for trends that are escalating even now. Discover how SWK can help you better fight the cybersecurity crisis and show you how to best strengthen your data security for 2022 by reading our free ebook included below.
Download our ebook here to learn more about the new cybersecurity crisis and how to protect your business with the help of SWK Technologies.