Biggest Cyber Attacks of 2018

With the rapid wave of digitalization, the way we manage our lives has changed. When we pay bills online, shop from e-commerce sites, book flight or movie tickets, search jobs, constantly update various aspects of our lives using social media platforms–we are putting our online identity and privacy at stake. And 2018 witnessed data breaches in a large scale. The attacks were sophisticated and the consequences affected millions of people.

Among the top 10 most targeted countries by cyber attackers, India is the fourth most targeted country in the world. We often allow permissions of our data in various apps, sites to avail some services without thinking about our online privacy. People across the globe are facing various kinds of threat actors affecting companies, businesses and individuals. The digital territory is riddled with potential security vulnerabilities and we are clearly not ready for the attacks yet to come.

The year of 2018 witnessed a long list of malware, ransomware and data breach incidents. Cyber Espionage grew to 12.2% from 9.9%.

Let's have a quick look at the worst security breaches happened in 2018 round the year:

1. Facebook Data Breach:

Facebook had been in the news this year for all the wrong reasons. The Cambridge Analytical scandal shook the world in March 2018 where personal data of 87 million Facebook users were compromised. UK based data firm Cambridge Analytica acquired the personal information from Facebook via an app that had the details to build the complete profile of a person – likes and dislikes, personality, political views, interests, social network engagement etc. The data was needed to build software that could target potential swing voters in political campaigns, including US President Donald Trump's 2016 election bid. At the end of September, Facebook disclosed another data breach where hackers compromised 30 million accounts by stealing "user authorization tokens". This allowed hackers to gain access to user's private information without requiring their original account password or validating two-factor authentication code. The massive hacks, of course, caused a crisis of faith on Facebook among people.

2. Aadhaar Massacre:

Aadhaar database is one of the largest Government databases in the world that contains demographic as well as biometric data of the citizens with a 12-digit unique identity number is assigned to individuals. The year started with a massive data breach of 1.1 Billion personal records of Indians holding Aadhaar card. UIDAI revealed that about 210 Government websites leaked the Aadhaar details of people on the internet and as a result a simple Google search would reveal thousands of databases along with demographic data including Aadhaar numbers, names, names of parents, PAN numbers, mobile numbers, religion, marks, the status of rejection of applications, bank account numbers, IFSC codes and other information. The shocking part was, anyone could get hold of Aadhaar card details of any individual by just paying a sum of Rs. 500 as the details were up for sell by some anonymous sellers over Whatsapp. With the additional 300, anyone could print the Aadhaar card.

3. British Airways Hack:

A large-scale hack on the British Airways website and mobile app left personal information of 380,000 British passengers exposed. The information included passenger names, home addresses, financial information like credit card number, expiry date, CVV codes etc. that are stolen in the breach.Hackers from criminal group, Magecart managed to gain both PII and payment details of the customers by spoofing the web domain that looked exactly like the legitimate one. The fraudsters installed malicious skimming code in its payment data entry forms so that whenever someone enters the information for reservation, all the credentials and data would silently go the servers of the attackers. This type of attack is called Formjacking and it is growing phenomenally which is a major concern for security researchers. Once the attackers manage to gain your financial information, it is up to them what they want to do with the data. Your financial data can be sold in dark web or it can be used for fraudulent purchases.

4. VPNFilter Attack:

Russian hackers aimed at compromising routers using a type of malware named VPNFilter. The campaign compromised 500,000 devices worldwide and the virus was designed to coordinate with the infected devices and turn them into a collective botnet. Now, this can be used to perform several malicious tasks like spying on victim's web activity and even manipulating it. It can also be used for stealing data and run spam campaigns or launch targeted attacks against particular victims. According to a blog published in Tripwire, "VPNFilter relies upon a command-and-control infrastructure set up by the gang, who can send commands to the botnet through metadata hidden within particular images on Photobucket.com. With the images removed from Photobucket, the VPNFilter botnet turned to a backup server, toknowall.com, for its instructions." VPNFilter has been seen affecting small office/home office routers from Linksys, MikroTik, Netgear, and TPLink, in addition to QNAP NAS devices.

5. Quora breach:

Even the last month was not an exception. The most popular question-answer site Quora suffered a massive data breach where sensitive information of 100 million users were compromised. As observed by the team, an unidentified malicious third-party managed to gain unauthorized access to one of its systems and stole data on approximately 100 million users—that's almost half of its entire user base. The personal information that have been exposed include email addresses, encrypted passwords, data extracted from linked social media accounts, questions, answers, comments, downvotes and direct messages. Quora logged out all the users from their compromised accounts and forced them to change passwords.

Besides these, there were high profile attacks that took place in 2018. In India alone, there had been several news of website hacking, data breach and new techniques of attacks. Trends show a huge increase in hacked and breached data from sources that are increasingly common in the workplace, like mobile and IoT devices.As more business infrastructure gets connected, Juniper Research data suggests that cybercrime will cost businesses over $2 trillion total in 2019.

So, we need to keep on learning from the lessons we got in 2018 and strive to become more aware in 2019 to fight with the threats coming along.

Want to suggest some more cyber-attacks to be included in the list? Leave your comment.

Tweet

Share