For some, it’s good riddance to 2016. However, to cybersecurity vendors, 2016 was a stellar year. Major cyber attacks hit companies resulting in nearly 2 billion user accounts being stolen or accessed in just nine of them. According to a study by Piper Jaffrey, there was nearly an 81% positive correlation between the number of breaches and revenue growth for companies in the cybersecurity industry. What were those incidents that made those vendors celebrate the year?
These included government agencies, the Democratic National Committee (DNC), healthcare, and social media, as well as the infamous Yahoo breach that resulted in over 1.5 billion accounts being accessed. These nine were significant for various reasons. They demonstrate that no industry is spared and regardless of the size of the breach, it can do damage to a organization, not only in reputation and costs to remedy the situation, but it may also affect business deals as is possible Verizon and Yahoo.
9. Oracle’s MICROS System: This one has an unknown number of affected users and it is unclear what information was retrieved. However, a Russian organized cybercrime group called Carbanak is being blamed. Malicious code was found in the system that Oracle uses to support its MICROS point-of-sale (POS) systems. The significance of this is that the hackers penetrated the support system where sensitive information about clients can be found.
Someone who wanted to do a lot of damage could use that to get into client systems and it could create a domino effect. The resulting damage of this one may never be fully known, but at least five cash-register providers using MICROS reported a breach after the Oracle incident. Those five customers supply an estimated one million POS systems around the world.
8. DNC: This one occurred during the height of the presidential election process and may have had an effect on the outcome. Leaked emails, reportedly resulting from Hillary Clinton’s campaign chairman falling victim to a phishing email, were retrieved and spread throughout the news media. Fingers were pointed at Russian hacker who calls him or herself Guccifer 2.0 who then handed over the email messages to WikiLeaks. Sensitive information of donors to the campaign was also released publicly.
After that, chaos broke loose in the DNC resulting in resignations of its chair, CEO, CFO, and Communications Director. Total Records Stolen: 27,286.
7. U.S. Navy and Hewlett-Packard Enterprises (HPE): In October, it was revealed that a laptop used by a contractor from HPE and working for the Navy, was accessed by unknown parties. Information on that laptop included details of over 134,000 Navy employees, both current and former. HPE promised to look into the matter as top priority. The significance is that the breach occurred due to a mistake of a third-party working on behalf of the Navy. Companies often overlook third-party service providers and vendors when it comes to security. This is one incident in which a contractor put a client’s personnel information at risk.
6. Verizon: A group broke into Verizon’s enterprise network accessing a “measly” 1.5 million records. Information included in this was contact information of Verizon’s clients. The ramifications of the effect this had on the company’s business in general is not clear, but since Verizon is a seller of security products, it could have resulted in a hit to its reputation and client trust. In addition, the clients were put at risk for additional phishing attacks.
5. 21st Century Oncology: This incident emphasizes the value of healthcare data on the black market. It can be sold for $50 per record. It also puts patients at risk for being victims of insurance fraud. While the Banner Health breach affected more people (3.7 million), the information stolen in that one was payment card data.
The information included in the 2.2 million records in this attack was what held the real value. It included patient diagnoses, treatment information, social security numbers, physicians’ names, and insurance information. Unfortunately, the healthcare industry was hit hard in 2016 and it isn’t expected to get a break in 2017.
4. U.S. Department of Health and Human Services (HHS): While this one was an actual physical theft of portable hard drives, 5 million individuals were victimized and the information stolen could be used to steal identities, as well as for healthcare fraud. Supposedly an aggrieved employee provided a key to someone who broke into a facility and stole the drives.
3. Weebly: This website hosting and building site was attacked late in the year affecting more than 43.5 customers. Information taken included user names and passwords and again like the Oracle MICROS and Verizon incidents, this demonstrates a potential for a domino effect of damage. Weebly is a third-party service provider and has information on many clients that may prove valuable to cybercriminals.
2. MySpace: Around 360 million accounts created prior to 2013 were affected when MySpace was attacked. Being blamed for this was “not-so-stellar” security measures of the company, which had not updated its systems adequately prior to that. Personal information such as user names, email address, and passwords were taken. It was a Russian hacker called “Peace” who is believed to have been involved.
1. Yahoo: Taking the top spot, is likely no surprise to anyone reading this. Yahoo was in the news a lot in 2016 for breaches. Two incidents resulted in information of 1.5 billion users being stolen. Data was from 2013, and 2014. Not only were so many people affected, but these incidents may still affect the sale of the company to Verizon, which as of writing is not completed. An executive at Verizon was quoted in the Wall Street Journal as saying, “Unfortunately, I can’t sit here today and say with confidence one way or the other because we still don’t know.”
Unfortunately, data breaches are so normal now that we don’t really even bat an eye at them. The Target breach of a few years ago caused that company to take the brunt of the bad press and hit to its reputation. That one affected between 70 and 110 million people. By the time Home Depot was breached in 2014, people were not surprised and accepted it. It may seem depressing, but it’s really a fact of our new reality.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
