Examples of Weak Cryptography being exploited in the wild by cybercriminals? As a theorist, I often motivate the need for strong cryptography via simplistic methods, such as &quot;If this did not exist, your online bank transactions would be vulnerable&quot;. This is of course true if &quot;this did not exist&quot; means that we are in Minicrypt (or some weaker &quot;world&quot;), but I also sometimes use this to motivate switching off of particular weak cryptographic primitives.
In this setting, it seems like social/legal conventions would mitigate the potential harm to the user --- for example, simple ways to attempt to leverage the total break of a cryptographic primitive (say transferring a ton of money into your personal bank account) would easily be undone through legal avenues.
In truth, I suspect that most of the hypotheticals that I can think of for how to nefariously exploit a broken cryptographic primitive in the wild would be easily reversed by law enforcement (perhaps I am just a bad cybercriminal though).
That, coupled with my perception that &quot;most&quot; cybercrime does not rely on breaking the &quot;actual&quot; cryptographic primitives that are used (and rather implementation errors/social engineering), makes me curious if cybercriminals have ever attacked underlying cryptographic primitives as part of their criminal enterprise.
I would be most interested in novel attacks / attacks against primitives that were thought to be strong beforehand, but as I suspect these do not exist I would also be interested in attacks against primitives that are known to be weak, provided they were against some notable company (where &quot;notable&quot; essentially means &quot;something an average person may have heard of&quot;).
I want to exclude attacks by governments in this question, as these (especially via the NSA) tend to be fairly well-documented already, and seem to mostly sidestep the &quot;law enforcement could/would undo the damage&quot; argument.
I would also be interested in attacks against primitives that are known to be weak, provided they were against some notable company (where &quot;notable&quot; essentially means &quot;something an average person may have heard of&quot;).

The first example that comes to mind in TJX's use of WEP 5 years after the break was announced; that lead to millions of credit cards being stolen.