7 Key Takeaways From 7 Data Breaches In 2019 To Guide Your Cybersecurity Strategy In 2020

7 Takeaways From Data Breaches In 2019

Here are seven key takeaways from data breaches in 2019.

1. Data Aggregators Will Be at Risk

Verifications.io, an email verification service provider, left its MongoDB database with more than 808 million records exposed. This means that anyone with an internet connection can access their database. The records include personal information such as email addresses, date of birth, phone numbers and physical addresses of employees. Some records even contained information about IP addresses and business leads. This clearly shows that organizations that are storing and using large amounts of user data are a prime target for hackers.

2. Cloud Storage Will Be the New Target

As more and more businesses migrate to the cloud, we will see that the cloud will become the next target for cyber attackers. Add to that the increased risks of insider threat and you will start to think twice before migrating to the cloud. This was evident when sensitive data of more than 100 million US citizens and 6 million Canadian citizens was accessed by an employer of AWS. The data belongs to people who have applied for a Capital One credit card. What’s even worse is the fact that the data also contains Social Security numbers and bank account details of secured credit card customers of Capital One.

A misconfigured firewall might be the main reason behind it as it enabled attackers to execute privileged commands to access the cloud server, which was hosting the data. Although this might not have happened if your data were stored on the best dedicated servers inside your premises, which is why some businesses are still reluctant to migrate all their data to the cloud.

3. You Can Pay the Price for Others’ Actions

Back in June 2019, American Medical Collection fell victim to a massive data breach when they were collecting overdue payments from two of their biggest customers. They realized that some unauthorized users are trying to access sensitive data of millions of patients. More than 20 million records were compromised (11.9 million belong to Quest Diagnostics and 7.7 million belong to LabCorp). After the breach, many customers sued the AMCA and they had to file for bankruptcy protection.

This is the best example for companies that are unaware of third-party risks. It brings to light the fact that your business partners, stakeholders, vendors and third parties you are interacting with should all follow cybersecurity best practices; otherwise, you will have to pay the price for someone else’s mistakes. Irrespective of how good your cybersecurity defenses are, if your third-party vendors don’t have the right security postures, your data is always at risk.

4. Insider Threats Are Real

This one is for those who take internal threats lightly. An insider at the Federal Emergency Management Agency shared personal details of more than 2.3 million survivors of Hurricane Harvey, Irma and Maria and California wildfires with a third-party contractor. FEMA was only required to share the name, date of birth and last four digits of the Social Security number so the contractors can easily verify the eligible candidates for disaster relief, but they ended up sharing physical addresses and even banking details of those survivors. Due to the oversharing of information, the risk of identity theft and fraud increased drastically.

5. Compliance is Not Enough

Earl Enterprises, a parent company of multiple restaurants such as Planet Hollywood, Buca di Beppo and Earl of Sandwich was attacked by unknown malware. The hackers were able to steal more than 2 million payment card numbers from customers. The worst part, the data breach was underway for ten months from May 2018 till March 2019 and no one knew about it.

This clearly shows that complying with PCI-DSS is not enough to protect you against data breaches. Such data breaches usually take advantage of back-end systems that are responsible for handling payment processing. This happens when your back-end server responsible for handling credit payments, is used for other unintended purposes.

6. Vulnerable Web Apps Are a Soft Target

Cybercriminals love to target web applications because they are vulnerable and can easily be compromised. The latest victim was Macy’s website which was hacked in October 2019. Data related to people shopping on Macy’s website such as name, address, payment card details, and phone numbers, was compromised. A group of Magecart attackers was successful in injecting malicious card skimming code on the checkout pages and was able to get their hands on the financial and sensitive personal data of users.

Keeping this in view, online retailers should beef up their cybersecurity and fix all the loopholes in web applications. Many hackers implement tactics such as SQL injections, cross-site scripting, session management, and broken authentication and you should protect your web application against these attacks. Research conducted by Positive Technology on web app security paints a gloomy picture. According to the study, 33% of web applications have extremely poor security and the number of critical flaws in web applications almost tripled as compared to last year. It also showed that 63% of attacks on E-commerce businesses targeted web services.

7. Supply Chain Attacks Will Grow

Hackers belonging to the Advanced Persistent Threat (APT) group used a combination of techniques such as phishing emails, penetration testing tools and a legitimate red team to compromise more than 100 systems at Wipro. Wipro is one of the largest outsourcing firms in India. Cybercriminals did not stop there. They installed Trojans, which gave them remote access to these systems and used advanced tools to get access to a dozen of Wipro’s customers’ systems.

With several Fortune 500 customers under its belt and the ability to provide access to other companies, it made them a lucrative target. Hackers knew that if they successfully intruded into their systems, they could also access data of other companies without having to target those companies directly with cyber-attacks.

Which cybersecurity lesson did you learn from data breaches in 2019? Let us know in the comments section below.