Previously, we discussed the different industries that are targeted for DDoS attacks. Below, we’ll begin by pointing out some interesting industry facts and then look at some examples of how hackers like to get creative with their revenue strategies.
Which Industry Is Most Vulnerable To Hacks?
Research performed by a Korean media company last year suggests that corporate CSOs and security managers believe the finance industry needs information security the most. This is also supported by the fact that; previously, financial institutions received the most cyber attacks compared to other industries.
Yes, we can all agree that financial firms are a valuable target to hackers as credit card information, bank account information, etc. can result in money takeover, thus resulting to secondary damage such as phishing and/or spam.
However, many institutions that aren’t in the finance industry, and many small businesses in general, fall under the impression that they’re not a target at all for hackers and are not vulnerable.
ComputerWorld mentioned that a study performed just last year by Ponemon Research showed that a staggering 90% of businesses reported their organization’s computer had been breached at least once or more within the past 12 months. This study involved 583 businesses ranging from small organizations of 1-500 people to organizations with employees of up to 75,000.
Below are some more examples of how the finance industry shouldn’t be the main industry who try to protect themselves from cyber attacks.
Hackers: In It For The Money
The direct purpose of hacking is, of course, an exchange of money for data leakage. Recently this year, Hollywood Presbyterian Medical Center were demanded to pay $17,000 by malicious hackers using the ransomware hacking technique.
After the hack, the hospital was forced be taken offline and had to use old-fashioned documentation techniques such as hand-writing patient details and surgical events.
Ransomware is usually a three-step process and begins in the email inbox of anyone under the use of the server being targeted. Often, the email will appear to be a legitimate bill providing a link that the reader will click out of curiosity.
The link leads to a Word document and once the readers clicks the “enable content” button, its game over and the hack is activated only able to be unlocked by a key that the hacker holds.
Not only did the hacker cause normal operations to stop, the hacker held valuable patient information and medical records. Hollywood Presbyterian Medical Center ended up paying the ransom, but fears of this happening again has escalated drastically.
Because a back-up plan and proper security precautions were not taken in the first place, this hospital now suffers from patients changing hospitals due to a questionable reputation.
Hackers going after financial value of the information are oftentimes involved with international crime groups, as it needs structural approach. That’s why their hacking method is daring and bold, and the damage can be easily numerically calculated which becomes big news on the media.
The Dark Web Market
In addition to ransomware, another financial incentive for hackers is the ability to sell information via the Dark Web. The Dark Web is essentially the black market of the internet. This environment is created through extremely sophisticated encryption and specific software only accessible to shared networks.
For example, when Korea’s Education Broadcasting company EBS’s database was leaked, one fourth of customer data was breached. Still, many didn’t appear to be too intimidated because EBS seemed calm due to customers’ SSN still being safe. Those victims thought that their information on education sites should be less dangerous than their information on bank sites.
However, these individuals received spam messages such as ‘getting a quick degree’ or ‘attendees for new semester’ from private institutions and educational companies that may have purchased customer information via the Dark Web.
Another example would be when the Japan Pension Service got hacked and 1.25 million cases of personal data was leaked. This was due to one of their staff members improperly accessing an external email virus. The system’s president apologized for the leak that included names, identification numbers, birth dates and addresses.
What’s interesting is that the police investigated hospitals, pharmacies, and pharmaceutical companies. Although the hacker was not identified, the police’s directions to investigate were smart.
The leaked data could have been received by a hospital or pharmacy, and since past disease information can be seen, it’s possible to sell personalized medical products or run specific ads. Or, they can even find a relevant target audience for new medicine.
Unlike credit cards, that can be unsubscribed or changed, medical records cannot change, so medical records are popular among hackers.
There’s No Such Thing As The ‘Most Vulnerable’ Industry
Hackers sell the value of potential customers. Like the Korean Education Institution case, hackers were not interested in the SSN from the beginning. They went after the classes people took, their scores, interested subjects and all these personal information. They wanted to know what these people’s interests were.
Even if some information seems negligible, that information means a lot to some people who can gather a story from this information. The hotel that someone stayed in, or the placed that someone ordered food can seem nothing, but it could mean a lot for the related businesses.
This is why small business that are very closely related to people’s daily lives are even more vulnerable, since these businesses hold very specific taste of users.
Please be careful and stay safe no matter how big or small your business is, or which industry you’re business is in because 2016 will be an eye-awakening year for cyber security and personal data.