Over the past few months, we have highlighted some of the biggest hacker attacks launched against a variety of different organizations. The purpose of the series was to show readers a few things:
- The risks that criminal hackers pose are real
- Any organization is at risk regardless of size or industry
- The way an organization responds to a breach makes all the difference
As we wrap up these weekly installments, we’d like to take the time review what we learned about data breaches and how they affect the different organizations and their customers.
Overall, the number of affected customers depended on the size of the organization. But more importantly, the hacking incidents covered show that there is no common trait that the victims share. The targets of the attacks we covered ranged from large publicly traded companies to government agencies. There were small start-up technology companies that appeared along with individual users of a product.
Hackers have shown that they do not discriminate. If your organization has something that they want, they will come after you. Anyone who has followed our Who Got Hacked series should come away understanding that they need to take security seriously, no matter what size their organization is.
How the Attacks Happen
Most attacks happened because the hacker was able to get some type of malware installed onto a computer in their victim’s network. Malware nowadays is typically built to allow the attacker access to their victim’s computer or network. This is usually done with the malware opening a backdoor or by stealing the usernames and passwords of the person’s computer that is infected.
Once the attacker has access to a computer or an account they are able to escalate their access privileges to the point where they can freely move about the network to look for the information they want.
Other attacks that we have seen use malware to capture payment card information and send that data back to the hacker. This information is also sent back to a central computer to be used in fraudulent transactions.
Certain organizations really stood out based on how they notified customers. Notifying customers of a data breach is not only required by law in most cases, but it is required to maintain the trust of those customers. As we have seen, people have come to understand that attacks do happen. It seems almost every day there is a major news story of someone being hacked, so customers can be more lenient. What they don’t stand for is being kept in the dark when their personal or financial information is compromised.
Organizations such as Brazillian Banks and Spotify that notified individual customers and made public announcements regarding what happened and the corrective actions being taken fared much better in the public eye than those who kept customers in the dark for extended periods of time.
For most victims covered in this series, there were financial implications after they were hacked. As we have seen, victims are often required to pay legal fees and fines if certain types of information are exposed. In other cases, the organization offers to pay for credit monitoring to protect the customers who were affected. In every instance, the organization that was hacked found themselves paying outside firms to investigate where the breach happened and how it could be fixed.
Fixing the Problem
Organizations need to understand that proactive security measures may cost money in the short run, but will often save the organization more money in the long run. Most of the time, this comes down to keeping technical controls up to date, educating employees on security and teaching them how to properly report any suspicious activity.
Hacking attacks will continue to make the news, and they will continue to threaten the place where you work. That doesn’t mean that we need to just sit back and let it happen to us. Each time a company is hacked we should all take it as a learning experience; mimic what they do right and avoid what they do wrong.