Top 5 Critical Sectors Targeted by Cyberattacks in 2024

December 27, 2024December 27, 2024

Cyberattacks on Critical Infrastructure: A Growing Concern for National Security

In recent years, the security of critical infrastructure has emerged as a pressing concern for governments and organizations worldwide. Cyberattacks targeting essential services have highlighted vulnerabilities that affect everything from our daily commutes to healthcare access. The rise in attacks on critical infrastructure, particularly since the 2021 Colonial Pipeline incident, emphasizes the urgent need for robust cybersecurity measures. This article explores the impact of cyberattacks on critical infrastructure and the sectors most affected in 2024.

Understanding the Threat to Critical Infrastructure

Critical infrastructure includes the systems and assets vital for the functioning of society, such as transportation, energy, and healthcare. In 2021, the Colonial Pipeline attack led to significant fuel shortages across the United States, prompting President Joe Biden to issue an executive order aimed at strengthening cybersecurity across 16 critical infrastructure sectors. This initiative laid the groundwork for the establishment of Critical Infrastructure Security and Resilience Month in 2022.

The Financial Impact of Cyberattacks

The financial repercussions of cyberattacks on critical infrastructure are staggering. According to a recent study by Claroty, nearly 45% of organizations reported losses of $500,000 or more due to cyberattacks affecting cyber-physical systems (CPSes) in the past year. The sectors most affected include:

Chemical manufacturing
Power and energy
Mining and materials

These findings underscore the pressing need for enhanced cybersecurity measures to safeguard critical infrastructure from evolving threats.

Major Cyberattacks of 2024

As we delve into the most significant cyberattacks of 2024, we see a troubling pattern across various sectors:

Manufacturing Sector

The manufacturing industry remains a prime target for cybercriminals, accounting for nearly 25% of all cyberattacks. Notable incidents include:

Lush: The UK cosmetics retailer experienced a cyberattack in January, where the Akira group claimed responsibility for stealing 110GB of sensitive data.
Schneider Electric: This company faced a ransomware attack from the HellCat group, which threatened to expose sensitive project data unless a ransom of $125,000 was paid.

Financial Services

Financial institutions are also heavily targeted, with significant breaches reported in 2024:

LoanDepot: A data breach from January exposed personal information of nearly 17 million customers.
Evolve Bank and Trust: In May, this bank reported a breach affecting 7.6 million individuals, compromising sensitive data such as Social Security numbers and account information.

Energy and Utilities

The energy sector has not been spared, with cyberattacks constituting approximately 11% of all incidents. Key attacks include:

Halliburton: This oil services giant reported a $35 million loss due to a cyberattack, which caused significant disruptions to its IT systems.
Duke Energy Florida: A breach occurred in May, leading to unauthorized access to personal customer information.

Retail Sector

Retailers are particularly vulnerable to third-party data breaches. A recent study revealed that 97% of the top 100 U.S. retailers experienced such breaches in the past year. Notable incidents include:

Ticketmaster: A breach involving Snowflake, a third-party data storage company, exposed sensitive customer information.

Healthcare Sector

The healthcare sector faced a monumental challenge in 2024 with the Change Healthcare incident, affecting 100 million Americans. This breach resulted in significant disruptions to payment systems, highlighting the critical need for stronger cybersecurity in healthcare.

Conclusion: The Path Forward

The increasing frequency and severity of cyberattacks on critical infrastructure underline the urgent need for enhanced security measures across all sectors. As organizations work to bolster their defenses, it is crucial for individuals and businesses to stay informed about cybersecurity best practices.

For more insights on cybersecurity and its implications for critical infrastructure, feel free to share your thoughts in the comments or explore related articles on our website. Understanding these threats is the first step in safeguarding our society’s essential services.

Learn More

Data Breach Affects 30K+ Postman Workspaces

December 26, 2024December 26, 2024

A major security breach has exposed over 30,000 API keys and sensitive credentials on Postman Workspaces, primarily due to access control misconfigurations and unintentional sharing. Investigations by CloudSEK’s TRIAD team revealed that many leaks originated from platforms like GitHub and Salesforce, putting various sectors at risk of data compromises. Experts recommend organizations implement secret management systems, conduct regular token rotations, restrict permissions, and secure collections before sharing. In response, Postman plans to enhance data protection by omitting public workspaces with exposed secrets from its API network starting in June, notifying affected users to remove sensitive data.

4 Strategies to Combat Generic Top-Level Domain Abuse

January 7, 2025January 7, 2025

Domain impersonation attacks, or domain mirroring, pose a serious threat by allowing cybercriminals to replicate established brands’ domain names, deceiving users. Techniques include lookalike domains, subdomain takeovers, and homograph attacks. Research indicates that new generic top-level domains (gTLDs) are increasingly exploited, constituting 37% of reported cybercrime domains, with 42% of phishing incidents linked to them. To combat these risks, organizations should implement security awareness training, monitor for similar domains, use email authentication standards, and consider brand protection services. Proactive measures can help safeguard digital identities and reputations against evolving cyber threats.

Stay Safe Online: Essential Cybersecurity Tips Every Employee Should Know in 2023

January 4, 2025January 4, 2025

In today’s digital age, cybersecurity is crucial as businesses increasingly depend on technology. Employees play a vital role in protecting sensitive information against evolving cyber threats. Key tips for 2023 include recognizing phishing attacks, using strong and unique passwords, enabling two-factor authentication, and keeping software updated. Employees should be cautious with public Wi-Fi, regularly back up data, and be aware of social engineering tactics. Securing personal devices and promptly reporting security incidents are also essential. Organizations should provide ongoing cybersecurity training to empower employees and foster a resilient cybersecurity culture, making safety a collective responsibility.

IntelBroker Exposes Massive Cisco Data Breach

December 19, 2024December 19, 2024

Cisco experienced a significant data breach involving 2.9 GB of sensitive information due to a misconfigured DevHub portal, disclosed by the threat actor IntelBroker. The compromised dataset, totaling 4.5 TB, includes critical components such as security policies for the Identity Services Engine, Secure Access Service Edge solutions, and the Webex platform. IntelBroker’s post on BreachForums suggests potential further exploitation of the data. While Cisco has not officially acknowledged the breach, it highlights the growing cybersecurity threats facing major tech companies and underscores the importance of robust security measures and regular configuration audits to prevent such incidents.

Chinese Hackers Target Telecoms in 12+ Countries with GHOSTSPIDER

December 1, 2024December 1, 2024

Cybersecurity experts report a surge in cyberattacks by the China-linked group Earth Estries, utilizing a new backdoor, GHOSTSPIDER, to target Southeast Asian telecom companies. This advanced persistent threat (APT) has compromised over 20 organizations, including those in telecommunications and government sectors across more than a dozen countries. Earth Estries employs various malware, including the Demodex rootkit and MASOL RAT, exploiting vulnerabilities in widely used software. Their operations are sophisticated, involving multi-modular implants and stealthy attacks that complicate detection. As telecoms remain key targets for such threat actors, heightened cybersecurity vigilance is crucial.

Mirai Botnet Targets Four-Faith Routers for DDoS Attacks

January 8, 2025January 8, 2025

A new variant of the Mirai botnet, named “gayfemboy,” is exploiting a critical vulnerability (CVE-2024-12856) in Four-Faith industrial routers, leading to increased distributed denial-of-service (DDoS) attacks since November 2024. This botnet, active since February 2024, targets weak Telnet credentials and over 20 known vulnerabilities, with approximately 15,000 active IP addresses primarily in China, Iran, Russia, Turkey, and the U.S. The attacks can generate traffic of around 100 Gbps and pose significant risks to enterprises and individual users. Experts emphasize the growing threat of DDoS attacks and the urgent need for improved cybersecurity measures.