Just two years ago, cybercriminal gangs were behind record-breaking data breaches that resulted in the theft of millions of customer records. But the year 2011 will be remembered as the year hacktivists out-stole cybercriminals to take the top data breach award, according to a new report released by Verizon on Thursday.
More than 100 million of the 174 million stolen records Verizon tracked in 2011 were stolen by hacktivist groups, according to the authors of Verizon’s 2012 Data Breach Investigations Report (.pdf).
Hacktivists have drastically changed their methods and goals since groups like milwOrm and G-Force Pakistan first emerged on the scene in the late ’90s to deface websites and conduct DDoS attacks for political motivation. Last year, activists moved beyond simple website defacements into large-scale data theft operations that netted e-mail spools and intellectual property from firms like HB Gary and Stratfor, who were targeted in high-profile, embarrassing breaches for touting anti-WikiLeaks and pro-government stances and services.
“Many, troubled by the shadowy nature of its origins and proclivity to embarrass victims, found this trend more frightening than other threats, whether real or imagined,” according to the authors of the Verizon report. “Doubly concerning for many organizations and executives was that target selection by these groups didn’t follow the logical lines of who has money and/or valuable information. Enemies are even scarier when you can’t predict their behavior.”
The disparity in numbers between hacktivists and criminal groups may lie in the kinds of organizations each group has targeted. Hacktivist groups focused on large, high-profile entities that had lots of data, whereas criminal groups have changed their focus in the last two years from large companies to smaller businesses that are less well-defended.
An example is the restaurant and hospitality industry, which has been the hardest hit industry when it comes to data loss, accounting for 54 percent of breaches. Retail was the next hardest hit, with 20 percent of breaches. This is not surprising since most criminal breaches are financially motivated, and these are the industries that process the credit and debit cards that thieves love to steal. But instead of focusing on breaching corporate headquarters of chain restaurants and hotels, thieves have focused on the point-of-sale systems the businesses use for processing bank card transactions, since they often lack basic security protections to keep intruders out.
In a case study included in the Verizon report, investigators found that a franchise restaurant in New England had connected its point-of-sale server to the internet without a firewall in place or an antivirus program installed. Employees also used the same server for accessing the internet and checking their personal e-mail accounts. Thieves had installed a keylogger on the server to collect bank card data as it was processed. Secret Service investigators later found that numerous outlets of this franchise restaurant throughout the U.S. had each been similarly compromised.
“Analysis determined that the corporate network had not been compromised,” according to Verizon. “It appeared that the attackers were compromising each location separately through remote administration services that were accessible from the Internet. Once the attackers gained access, keylogging software programs were installed to capture the payment card data.”
More than 112,000 payment cards were compromised from 163 franchise locations, and at least 800 other retail computer systems in various hotels, movie theaters, medical facilities, cafes and pizzerias were also compromised by the same group, resulting in more than $20 million in losses.
Now in its eighth year, Verizon has added new partners to its annual data breach report. In addition to data taken from forensic investigations conducted by Verizon’s RISK Team, the United States Secret Service and the Dutch National High Tech Crime Unit — the latter two being partners who also contributed to last year’s report — the report this year encompasses data taken from cases investigated by the Australian Federal Police, Irish Reporting and Information Security Service, and the Police Central e-Crime Unit of the London Metropolitan Police.
The report combines data from 855 incidents that involved more than 174 million compromised records, an explosion of data loss compared to last year’s 4 million records stolen. The increase is due largely to the massive breaches perpetrated by activists.
The report doesn’t tell the whole picture, however. It doesn’t include information about the real cost of breaches. Particularly there are no statistics about the number of financial breaches against small businesses, colleges and universities in which thieves stole bank account data and initiated wire transfers. So-called ACH crimes, for the Automated Clearing House system that is used for wire transfers of money, has been an ongoing problem that has cost small businesses tens of millions of dollars, according to the FBI, and is one of the easiest ways for crooks to steal a lot of cash fast.
Most breaches Verizon tracked were opportunistic intrusions rather than targeted ones, occurring simply because the victim had an easily exploitable weakness rather than because they were specifically chosen by the attacker. And, as with previous years, most breaches — 96 percent — were not difficult to accomplish, suggesting they would have been avoidable if companies had implemented basic security measures.
Verizon noticed a difference between how large and small organizations are breached. Smaller organizations tend to be breached through active hacking, involving vulnerabilities in websites and other systems and brute force attacks. Larger companies are more often breached through social engineering and phishing attacks — sending e-mail to employees to trick them into clicking on malicious attachments and links so that the intruders can install malware that steals employee credentials. Verizon surmises that this is because larger organizations tend to have better perimeter protections, forcing intruders to use human vulnerabilities to breach these networks instead.