Cybercrime has been on the rise for years now, and it is not showing any signs of slowing down. Indeed, the arrival of the COVID-19 pandemic in 2020 just fueled the situation, and the number of attacks is escalating.
Here are important data breach statistics that can help you better understand the risk landscape for 2021.
5 major cyberattacks in the first half of 2021
We have barely crossed the first half of 2021 and already several huge cyberattacks have made the headlines:
- MeetMindful — In January 2021, a well-known hacker breached MeetMindful.com, a dating website, and leaked the details of more than 2.28 million of its registered users as a free download on a publicly accessible hacking forum. The data included users’ real names, email addresses, addresses (city, state, ZIP code), birth dates, IP addresses, bcrypt-hashed account passwords, Facebook user IDs, and Facebook authentication tokens. While full details are not included for all accounts, for many MeetMindful users, the leaked data is enough to trace their dating profiles back to their real-world identities.
- Florida water system — In February 2021, hackers breached the computer system operating the water supply in Florida, boosting treatment chemicals to dangerous levels. A water operator at the plant could only watch helplessly as a remotely controlled mouse drifted across his computer screen, skyrocketing the levels of lye (a caustic chemical used to control water acidity and remove harmful metals from drinking water) from the usual 100 parts per million to a highly toxic 11,100 parts per million. Luckily, the operator was able to restore chemical levels to normal once hackers exited the system, narrowly averting a disaster that could have poisoned 15,000 people in the small city of Oldsmar.
- HAFNIUM attack — Cybercriminals exploited four zero-day vulnerabilities in Microsoft Exchange Server email software to access email accounts at least 30,000 organizations across the United States, including small businesses and local governments. The cyberattack gave them total remote control over affected systems, allowing data theft and further compromise. Microsoft has released security patches for these bugs and urged and customers to apply them immediately.
- Facebook — April began with the discovery of the personal details of 533 million Facebook users on a hacking forum. The freely available data included the names, phone numbers and dates of birth of Facebook users across 106 countries, including data on 32 million US citizens. The data came from a vulnerability that was patched by Facebook in August 2019. Facebook has confirmed the legitimacy of the data but says it will not be informing users whose details were exposed by the breach.
- Colonial Pipeline — In May 2021, Colonial Pipeline, the operator of the largest fuel pipeline in the US, was hit with a devastating cyberattack that forced the company to shut down 5,500 miles of pipeline, crippling gas delivery systems in Southeastern states. The company confirmed it paid $4.4m to attackers. Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system
Cost of a data breach
- The average total cost of a data breach has increased by 10% since 2014.
The average total cost of a data breach in 2020 was $3.86 million. That’s a slight decrease from $3.92M in 2019, but an increase of 10% since 2014, when it was $3.50M. The weighted average is $3.79M over seven years. (IBM)
- The average total cost of a data breach varies by country.
Organizations in the United States had the highest average total cost at $8.64M, followed by the Middle East at $6.52M. The lowest costs were in Latin America ($1.68M) and Brazil ($1.12M). (IBM)
- Organizations subject to more rigorous regulatory requirements had higher average data breach costs.
Healthcare, energy, financial services and pharmaceuticals experienced an average total cost of a data breach significantly higher than less regulated industries such as hospitality, media and research. Public sector organizations have the lowest cost because they are unlikely to experience a significant loss of customers as a result of a data breach. (IBM)
Impact of COVID-19
Cybercriminals are leveraging the global pandemic to push new malware and increase spear phishing attacks across North America and Europe. Cynet reports that in the past, cybercriminals used existing malware in 80% of attacks and new malware in 20% of attacks on a worldwide basis. However, when the pandemic hit, there was an increase in the number of new phishing attempts, new malware variants and even new malware. Now, new malware accounts for 35% of attacks, an increase of 75%.
Causes of a data breach
Even in a year as unexpected as 2020, there are some things we can trust to stay the same. According to Verizon, phishing continues to be the top cause of breaches (36%), as it has been for the past two years. It is followed by use of stolen credentials (25%) and ransomware (10%).
Trend in data breaches caused by a malicious attack
The share of breaches caused by malicious attacks has increased steadily over time, from 42% in 2014 to 52% in 2020. This 10-percentage point increase represents a nearly 24% increase (growth rate) in the share of breaches caused by malicious attacks. (IBM)
Motivations behind cyberattacks
As in past years, financially motivated attacks continue to be the most common. Nearly 80% of cyberattacks are for financial gain, such as stealing money directly from financial accounts, stealing credit card information or other salable data, or demanding ransom. In second place is espionage, which often involves the theft of intellectual property or other confidential information. (Verizon)
Types of data targeted
Credentials remain the most sought-after type of data. Personal data is a close second, since Social Security numbers, insurance information, names, addresses, and other personal data can be readily monetized or used for financial fraud. (Verizon)
Individuals held responsible for breaches
CISOs are most likely to be held ultimately responsible for a data breach. CEOs and COOs are least likely to be held responsible for a data breach, while the CIO/CTO role is most often considered the ultimate decision maker for cybersecurity policy and technology. (IBM)
Cybersecurity spending trends
With the coronavirus crisis creating new opportunities for cybercriminals, organizations are seeing the value of increasing their investments in cybersecurity solutions. Indeed, 68% of major public and private organizations plan to increase their cybersecurity spending as a response to the growing number of cybercrimes such as data breaches, phishing and ransomware attacks. (LearnBonds)
