Top 5 Cyber Security Hacks of 2021

2021 was a record year for data breaches. With the pandemic still a large part of our lives and with a large part of the workforce working remotely opportunities were rife for Cyber Criminals. With two of the top social media companies being hacked in 2021.

Another trend is the increase in lack of transparency of companies when it comes to data breaches. Only a select few of the breaches become public knowledge with many companies deciding not to disclose breaches. This is growing concern for us as individuals as we are often not aware when our data has been compromised and is being used other than how we intended it to be.

Here are our top 5 Cyber Security hacks of 2021:

Linkedin

The personal data of nearly 700 million Linkedin users was on sale online. On inspection the data seemed to be recent, with many users reporting that their changes from 2020 and 2021 were reflecting. Luckily the data did not include login credentials or financial information. However, it did include all user’s personal information, this could be used to assume a person’s identity or sold countless times for marketing purposes to any number of companies. What was included:

• Full name
• Contact details
• Physical address
• Email address
• Geolocation
• Geolocation
• Linkedin username and profile URL’s
• Personal and professional experience
• Genders

In an article on Fortune a Linkedin spokesperson disputed some of the claims and said that evidence was low that it was a recent breach and that the Linkedin database had been merged with other data to enrich it. In addition to this they said the source of the data was not a breach but rather a threat actor pulling data that was publicly available on a large scale.

Facebook

Despite their amount of resources Facebook (Meta now) is not even immune from Cyber Criminals. Security researcher Alon Gal uncovered a database belonging to Facebook which contained an estimate of 533 million records.

The breach was concerning because it contained personal information and contact information that could be used to impersonate and individual and through various channels and tactics reveal more information about a user.

An attack like this is a concern because it enables hackers to easily perform social-engineering attacks or hacking attempts. An example of this could be resetting a password by leveraging a phone number and an email address.

The Colonial Pipeline Attack

The Colonial Pipeline Attack was one of the most impactful hacks of 2021. In May, criminals associated with the group Darkside accessed the network of Colonial Pipeline, one of America’s largest oil and gas companies. With this access they temporarily halted the pipelines operation, leading to a an energy crisis across the Southeast. In addition to the halting of operations they also downloaded an estimated 100 gigabytes of data, threatening to release this data if a ransom was not paid.

We are unsure of what happened after this occurred. This is often when the public are left in the dark, it us unknown if they were paid the ransom or another method was used. This attack is one of concern as it shows the impact that a hack could have on almost any company, making us all possible victims of ransomware.

Accenture

In August 2021, Accenture confirmed they LockBit ransomware operators stole data from them during an attack on the companies systems. The team at Lockbit claimed to have stolen almost six terabytes worth of data from the network.

In order to retrieve the data they wanted $50 million ransom. It is unknown how they got access to their network but there is speculation that it was an inside job. With Lockbit updating their website with the following statement: “these people are beyond privacy and security. I really hope that their services are better than what I saw as an insider. If you’re interested in buying some databases, reach us.”

Microsoft Exchange Server

Yes, even Microsoft can get hacked. In the start of 2021 four zero-day vulnerabilities were exposed by Microsoft, known commonly in the industry as ProxyLogon. Shortly after the vulnerabilities were exposed Microsoft patched them. However, the extend of the hack was never clearly quantified as users that did not update were still vulnerable.

When the vulnerability was found Microsoft said that the bugs were being actively exploited in “limited targeted attacks”. The Microsoft exchange server is an email inbox, calendar, and team solution that businesses both small and largeuse.

No signs of slowing down

With 2021 being a record year with regards to attacks, security experts believe that 2022 could also set a record. A growing popularity of services such as “Ransomware-as a-service” enables more people to hack more systems more often. It is not to say that all hope is lost but we have to remain vigilant and to always be not one step but three steps ahead of Cyber Criminals.

‍