2020 has become the year of change and challenge.
During the COVID-19 pandemic, the business has changed radically for nearly every organization across the world. They are faced with overwhelming, competing challenges as they continue to navigate the crisis.
Cybersecurity is one such challenge that concerned businesses amidst the uncertainty. While organizations have focused on newly pressing concerns-employee well-being, finance availability, and operational resilience—cybersecurity threats and attacks have escalated rapidly.
RiskBased Security’s publication of the 2020 Data Breach Report listed 2020 as the ‘worst year on record‘ by the end of the second quarter in terms of the number of records exposed due to data breaches.
As per the report, the number of records exposed in the first three quarters of 2020 reached a staggering 36 billion, with the three months of Q3 adding 8.3 billion records.
In January, cosmetics giant Estée Lauder exposed its database containing over 440 million records on the internet. As per the company, the database was from an “education platform,” which did not contain consumer data.
On January 22, 2020, the tech giant Microsoft disclosed a data breach that occurred on December 5, 2019, due to the misconfiguration of an internal customer support database.
According to ZDNet, the breach exposed 250 million records containing information such as email addresses, IP addresses, and support case details.
Unacademy, one of the popular online education platforms in India, was hacked in January this year. The security breach led to the exposure of data of around 20 million of its users.
The malicious actor gained access to the entire database of Unacademy and had put the stolen data on sale in the hacker forum for USD 2,000.
The exposed database also included numerous accounts using corporate emails of Infosys, Wipro, Google, Cognizant, and Facebook.
In February this year, market analysis firm Tetrad left data of 120 million customers exposed in Amazon S3 storage. The exposed data comprised sensitive information from providers Claritas/Nielsen’s PRIZM and Experian Mosaic and Tetrad customers like Kate Spade, Chipotle, and Bevmo.
Three text files with Mosaic data, each over 10 GB, contained a total of 130 million rows of data on US households. These files included household addresses, names of the head of the household, gender, and Mosaic group ID.
In February 2020, MGM Grand notified a massive data breach that occurred last year. The breach exposed records of over 10 million hotel guests, including Justin Bieber, Twitter CEO Jack Dorsey, and many prominent government officials.
The malicious actor uploaded the personal information of 10.6 million hotel guests on a hacker forum for free. However, in later findings, the stolen records reached nearly 142 million.
On March 31, 2020, the American hospitality company Marriott International disclosed a cybersecurity breach that exposed data of over 5.2 million hotel guests who used the company’s loyalty application.
The malicious actors acquired the login credentials of two Marriott employees to access the guest information.
Adult video streaming website CAM4.com, owned by Irish company Granity Entertainment, inadvertently left its database available for public view without any adequate security measures.
A security team from SafetyDetectives has discovered the significant data leak stretching into billions of records and alerted the company.
Cybercriminals could have exploited this data to conduct identity theft, phishing scams, website attacks, and blackmailing. The blackmail scams are possibly the most significant risk as most users prefer to stay anonymous on such websites.
Advanced Info Service (AIS), a major Thailand-based mobile network operator, left its database exposed and publicly accessible. The unsecured database contained a combination of DNS query logs, NetFlow logs, and other data related to the customers’ internet usage patterns.
In March 2020, Keepnet Labs, a UK based security firm, announced a data breach that exposed over 5 billion records.
As a part of its ‘threat intelligence service’ offerings, the Keepnet collects and stores publicly known data-breach information in its own Elasticsearch database. In March, the company started performing scheduled maintenance and was migrating the ElasticSearch database.
Regrettably, the engineer responsible disabled the firewall for about 10 minutes to speed up the process. During this window, the internet indexing service BinaryEdge indexed the data, making it publicly accessible. The exposed data contained information about reported data breaches throughout 2012-2019.
In March this year, the Chinese social media platform Weibo suffered a data breach that exposed the data of over 500 million users.
The hacker gained access to a database that contained the details of 538 million users and sold the data for USD 250 on the dark web.
Antheus Tecnologia, a Brazil-based biometrics company specialized in developing Fingerprint Identification Systems (AFIS), left sensitive information, including 76,000 unique fingerprint records, exposed on an unsecured server. The exposed server contained 2.3 million data points, which could be reverse-engineered to rebuild each original fingerprint.
Apart from the fingerprint data, the vulnerable server also exposed 81.5 million records that included administrator login information, employee phone numbers, email addresses, and company emails.
In April 2020, Nintendo announced that it suffered a cyberattack, and 160,000 user accounts have been compromised. Upon further investigation, the compromised accounts reached 300,000. The hackers used the stolen accounts to buy coveted digital items.
Following the incident, Nintendo stopped allowing users to login with their Nintendo Network ID (NNID). The company also advised the users to enable two-factor authentication.
Amid the remote working culture triggered by the pandemic, Zoom video conferencing app has become the most used application for virtual meetings and online collaboration. When the Zoom sign-ins were reaching their peak in April 2020, cybercriminals launched a series of credential stuffing attacks on the app and stole more than half a million accounts.
At least 530,000 Zoom accounts were listed for sale on the dark web and hacker forums.
The malicious actors not only gained access to the accounts but also to the contents of any meetings the users have either hosted or participated in.
Magellan Health, a Fortune 500 company, fell victim to a ransomware attack in April 2020, where over 365,000 patient records were compromised.
Initially, the hackers installed malware to acquire employee login credentials. Then, by impersonating a Magellan client in a phishing attack, they gained access to a corporate server and implemented their ransomware.
The malicious actors could steal employees’ login credentials, personal information and ID numbers, and sensitive patient details such as W-2 information, Social Security numbers, and taxpayer ID numbers.
Easyjet, the UK-based low-cost airline, experienced a highly sophisticated data breach that exfiltrated 9 million customers’ data. The compromised data included email addresses, travel details, and credit card information of 2,200 customers.
Wattpad, the most popular website for writers to publish new user-generated stories, suffered a massive data breach that exposed almost 271 million records.
The stolen Wattpad database was initially sold in private sales for over USD 100,000 and then sold on hacker forums for free.
The most popular microblogging platform Twitter suffered a security breach through a phone spear-phishing attack in July this year. The threat actors used specific employee credentials to gain access to Twitter’s internal systems. They targeted 130 Twitter accounts, including that of high-profile US personalities like Barack Obama, Joseph R. Biden Jr., Bill Gates, Elon Musk, Kim Kardashian, and many more.
The threat actors were able to tweet from 45 accounts, access the DM inbox of 36, and download the Twitter Data of 7.
“I am giving back to the community. All bitcoin sent to the address below will be sent back doubled! If you send USD 1000, I will send back USD 2000. Only doing this for 30 minutes,” read one of the tweets by hackers.
The tweet reached at least 350 million users, and the attackers swindled USD 120,000 worth of bitcoin through at least 300 transactions.
Mailfire, an email marketing firm, suffered a massive data breach that exposed users of over 70 adult dating and e-commerce websites, all using Mailfire software.
The hacker gained access to the software through Mailfire’s unsecured Elasticsearch server and acquired around 320 million data records of over 100,000 users.
Also Read: American HealthCare Provider Experiences Cyberattack, 295,617 Patients’ Data Exposed!
India’s biggest online grocery store BigBasket suffered a massive data breach in October 2020 that exposed 20 million users’ data.
The hackers exfiltrated users’ sensitive information and put it up for sale on the dark web for USD 40,000. Though the breach was identified on October 14, the company notified the public on November 7.
In October 2020, a cluster of databases belonging to the Voice over IP (VoIP) telecommunications vendor Broadvoice was left publicly accessible on the internet, without any need for authentication.
Comparitech’s security experts discovered the unprotected database cluster, which contained more than 350 million records.
Vertafore, a US-based insurance software solutions provider, fell victim to a massive data breach that exposed the data of 27.7 million Texas drivers. The threat actors gained access to three data files inadvertently stored in an unsecured external storage system. The exposed files contained information on driver’s licenses issued before February 2019.
The Home Depot, Inc., the largest home improvement retailer in the US, has reached a USD 17.5 million settlement with 46 states and Columbian District for the data breach it suffered in 2014. The breach exposed the payment card information of around 40 million consumers across America. The cybercriminals gained access to the company’s network and deployed malware on the self-checkout Point-of-Sale (PoS) system.
FireEye, the world’s leading cybersecurity firm, disclosed that they were attacked by a highly sophisticated malicious actor. The company informed that the attacker stole their Red Team assessment tools that they use to test their customers’ security. They believed that it was a state-sponsored attack based on the attacker’s discipline, operational security, and techniques.
 This attack is different from the tens of thousands of incidents we have responded to throughout the years,” said FireEye CEO Kevin Mandia.
HM Revenue and Customs was branded “breath-taking incompetence” after it experienced a dozen serious personal data breaches over the course of 2019-20. UK’s tax authority reported 11 incidents that impacted 23,173 customers, with one incident alone affecting around 18,864.
Leonardo SpA, the largest defense contractor globally, experienced a malware attack that exfiltrated data up to 10GB. Two former employees of the Italian company were arrested for allegedly compromising the corporation’s network by deploying malware.
Clearly, 2020 has been so far quite challenging for organizations in terms of cybersecurity along with the adoption of new normal changes. As the uncertainty unfolds, organizations that have yet to experience a cyberattack still have the luxury of time to prepare.
Unfortunately, most organizations are still ill-equipped to handle a significant cybersecurity incident, much less amid a crisis like a pandemic. According to the Ponemon Institute, 76% of organizations don’t have a Cybersecurity Incident Response Plan (CSIRP) applied consistently across the enterprise.
Thus, organizations without a CSRIP must build one, and those that have already created one should take the opportunity now to assess the CSIRP for any vulnerabilities based on their COVID-19 security posture.
Experiencing a cyber incident? StealthLabs can help you!
Infographic: Why Businesses Need Cyber Security Compliance?
