Incident Response: Lessons from Major Breaches

There has been a notable increase in cyber assaults in 2024, which have revealed weaknesses and resulted in extensive data breaches in numerous industries.

Cyber assaults are typically documented and scrutinized over time, and the complete ramifications of certain incidents may not be immediately apparent. However, considering patterns and documented incidents, it is reasonable to anticipate that various forms of attacks will likely be widespread in 2024.

Ransomware

Cybercriminals specializing in ransomware often direct their attacks toward critical infrastructure, healthcare institutions, and businesses, intending to extort financial benefits.

Regrettably, as outlined in the Gen Q2/2024 Threat Report, the menace posed by ransomware shows no signs of diminishing; on the contrary, it is escalating.

Data Breaches

Data breaches remain a lucrative target for cybercriminals, who seek to obtain sensitive personal and corporate information. Such breaches have severe consequences, including identity theft, financial fraud, and damage to reputation. Data that is highly sought after by fraudsters globally includes:

• Employee login credentials
• Customer credit card information
• Social Insurance Numbers
• Bank account numbers

Data Breaches Report from 2024

Interestingly, the average cost of data breaches has decreased compared to the previous year. Additionally, Canada has dropped from the third position globally for the costliest data breaches to the sixth position.

This reduction in breach costs can be attributed in part to 61% of Canadian companies’ adoption of security AI and automation to prevent such incidents. According to a study conducted by IBM, companies that heavily incorporate Artificial Intelligence (AI) and automation into their security operations experienced breach lifecycles that were 54 days shorter than those organizations that did not utilize these technologies.

Daina Proctor, IBM Canada’s security service line delivery leader, commented:

Canadian organizations that invest in AI and automation will be better equipped to detect and recover from breaches, reducing the significant costs associated with these events.”

“The findings of this report underscore the business imperative for companies to integrate AI and automation into their cybersecurity programs to reduce both the financial impact and business disruption of cyber breaches.

Evolution of Ransomware Tactics

Ransomware attacks have increased13% rise in ransomware attacks over the past five years, with an average cost of CA 2.57 million per incident in 2023.

The escalation in attack volume is evident, as organizations worldwide detected nearly half a billion ransomware attacks in 2022.

“The Gen Threat Report, formerly known as the Avast Threat Report, has revealed a 100% increase in ransomware activity for the US, UK, and Canada; 66% in Australia; and a whopping 379% in India.” – Nyrmah J. Reina

The severity of these attacks has also intensified. The average downtime a company experiences after a ransomware attack is now 24 days, causing significant disruptions to business operations. Moreover, the financial demands have reached unprecedented levels, with the highest ransomware payment demand ever recorded being CA 97.16 million.

Negotiation Strategies and Outcomes

As ransomware attacks have become more sophisticated, so too have the negotiation strategies employed by both attackers and victims. Cybercriminals have become more strategic in setting ransom expectations, often basing their demands on open-source information about the target organization’s revenue or cyber insurance coverage.

Ransomware negotiators play a crucial role in managing these high-stakes situations.

They engage with threat groups on behalf of the affected organization, attempting to lower ransom demands and buy time for the victim. However, some ransomware authors have threatened to delete decryption keys if professional negotiators intervene, adding another layer of complexity to the process.

Emerging Threats: AI and Deepfakes

Growth of AI-assisted Attacks

The rapid adoption of artificial intelligence (AI) has introduced complex cybersecurity risks that traditional practices may not sufficiently address. From January to February 2023 alone, researchers observed a 135% increase in ‘novel social engineering attacks,’ corresponding to the widespread adoption of ChatGPT. This surge highlights the growing threat of  AI-assisted cyberattacks.

One of the most significant concerns is using AI in social engineering attacks. Cybercriminals can now leverage AI language models to study a target’s entire email history and communication patterns, crafting perfectly authentic-sounding phishing messages. This capability allows them to build trust quickly and increase the likelihood of successful exploitation.

Can you spot the deepfake? How AI is threatening elections

Deepfake Risks for Businesses

Deepfakes – synthetic, AI-generated media designed to manipulate or replace existing video, image, or audio content with a fabricated version – pose a significant threat to businesses and individuals alike. These AI-generated fakes can have serious consequences, such as influencing political decisions or causing public panic.

Deepfakes can be used to undermine brand reputation, impersonate leaders and financial officers, and compromise vital data and systems. For example, a fake but realistic-looking video of a CEO making inappropriate comments or contradictory statements can severely damage a brand’s image and lead to significant reputation loss.