The first two months of 2023 show why businesses need to prioritise cybersecurity, suggests AJ Thompson, CCO, at the IT firm Northdoor plc.
The year 2022 proved full of high profile cyber attacks, with incidents occurring across all sectors and business types. However, if businesses thought the worse was over, then unfortunately, they are in for a rude awakening as the beginning of 2023 has shown that cybercriminals are more active than ever and more capable than ever of hacking into systems and getting their hands on data. With less than two months of the year gone, we have already seen these attacks:
Royal Mail – ransomware attack by a Russian hacker group which led to chaos across its international postal services;
PayPal – hackers gained access to nearly 35,000 customer’s personal data, including name, address, Social Security numbers, tax ID and/or date of birth;
MailChimp – the email marketing and newsletter company was hacked, with dozens of customers’ data exposed; the second successful hack on the company in the past six months;
DNV – a shipping firm saw a ransomware attack affect 70 companies and potentially 1,000 vessels
UK schools – 14 UK schools were hit with ransomware attacks, with some of the pupil data (much of it old) being released onto the dark web after the ransoms were not paid.
ION Trading UK – a ransomware attack on the financial data firm saw scores of brokers unable to process derivatives trades. However, the gang behind the attack said that the ransom had been paid by an anonymous benefactor.
AJ Thompson, pictured, said: “The first couple of months of 2023 have highlighted the threat from cybercriminals to all companies across all sectors. Whilst these high-profile attacks have hit the headlines, many companies will have been the victims of cybercrime, directly or indirectly over the past few weeks.
“There can be no complacency from anyone. All companies hold sensitive data of some kind or another, which will be of some value to cybercriminals. Recognising that fact is the first step for most companies.
“Without understanding what data is held, where it is stored and what could be safely disposed of, companies cannot effectively protect themselves. The key is to stop the cybercriminal from getting through in the first place.
“The weakest point in most companies are the employees. This situation has become worse since more employees are working out of the office or in hybrid roles. This leaves them out of the corporate network and potentially working on personal devices that are not updated or patched.
“Some solutions constantly warn employees of potential dangers. However, the messages and alerts bombarding users have caused ‘security fatigue’ in some. This has led to employees making rash decisions, and ignoring all warnings, even the most urgent ones. This has made it easier for cybercriminals to gain access to systems.
“Only warning employees at the point of danger is the key. This allows decisions to be made at the right time without being lost amongst other, less urgent messages. With the threat from cybercriminals very obviously increasing, companies have to ensure that all vulnerabilities are closed, systems are patched, and employees are no longer the weakest link.”
