Four Major Cyber Attacks In 2022: How To Not Repeat History In 2023

Brought To You By Rene Mulyandari 

Twitter, Medibank, Optus, and Ronin are among the worst cyber crime cases reported in 2022. How can tools such as attack surface management prevent hacking from taking place?

“Those who don’t learn from history are condemned to repeat it.” The field of cybersecurity is not exempt from this saying. Going into 2023, what should you know about the worst cyber attacks that occurred in 2022 and what can we learn from them to avoid repeating history?

Here, we cover attacks and data breaches that affected the users of Twitter, Medibank, Optus, and Ronin.

#1 Twitter

In August 2022, Twitter shared that hackers had exploited a flaw that appeared after a code update in June 2021. The bug was detected and fixed in January 2022 and the company believed no one exploited it at the time. However, in July 2022, Twitter learned that criminals had discovered the bug and misused it to obtain sensitive user information and compromise user accounts.

As a result, 5.4 million user accounts have been compromised in the breach. The data made available for purchase on hacking forums includes user phone numbers and email addresses. The users whose information had been compromised have been notified by the company. Could the exploitation of this zero-day vulnerability have been avoided?

One of the security solutions that companies use to detect, test for vulnerabilities and analyze is attack surface management. 

To pinpoint issues in real-time, attack surface management uses artificial intelligence and automatically tests the entire attack surface against all known and zero-day vulnerabilities.  The data of the testing and analysis is displayed on a single dashboard in a risk-focused report that aids security analysts to prioritize their tasks — focus on the major risks first.

The tool is linked to the resource MITRE ATT&CK Framework which lists new hacking techniques.

#2 Medibank

In November 2022, major Australian health insurer Medibank suffered a cyber attack that gave intruders access to the data of 9.7 million users. The data breach happened after the well-known ransomware group REvil gained access to the company’s systems using the stolen credentials of a user with high privileges.

The attack on Medibank, like many others, was financially motivated. The threat actors demanded a ransom be paid in exchange for not leaking the sensitive medical data they obtained from the insurer.

The company refused to pay the ransom since this action would encourage and finance further criminal activity. Also, there was no guarantee that the sensitive information would be returned or not leaked regardless. As a result, the criminals behind the breach went public with sensitive information such as passport numbers, customer names, birth dates, medical claims, and more.

In November, the threat actors leaked what is believed to be the last 5G of the data that was obtained in the breach. They shared it in a hacking forum. Customers whose information has been revealed on the dark web are susceptible to further criminal activity such as identity theft.

Retaining control over the large amount of data that the company stores in the system is a challenge. So how can you prevent major incidents like this?

Data breach protection includes:

#3 Optus

In October 2022, another high-profile hacking case hit an Australian company. This time, the victim was the telecom giant, Optus. The data breach compromised the information of 11 million users in one of the worst cyber attacks ever recorded in Australia. The users (current and former ones dating back to 2017) whose sensitive data has been obtained in the breach were notified. The company claims that it stopped the attack as soon as it had been identified in the system.

What caused this data breach?

The company initially claimed that sophisticated hacking was to blame for the breach. Later, it was reported that the threat actor got unauthorized access to the company’s network by exploiting a publicly available API endpoint.

Unprotected APIs leave the company exposed and can grant access to the database without the criminal having to log into the system.

Affected customers are at heightened risk of phishing attacks as well as identity fraud. Namely, the information that has been leaked includes birth dates, Medicare ID numbers, passports, emails, home addresses, and driver’s licenses.

This case is a reminder that even companies that have multiple layers of protection and strong security can suffer a breach if the security is not thorough and leaves basic vulnerabilities to be exploited within the system.

#4 Ronin Network Attack 

In March 2022, the blockchain network known as Ronin suffered a cyberattack that resulted in $600 million in stolen digital assets. It was considered to be the second biggest crypto hack ever. Threat actors behind the attack have been identified as the Lazarus group. They obtained access using the private keys that enabled them to approve several transactions.

How was the attack possible?

Ronin is linked to the game Axie Infinity. The hackers discovered outdated accounts with high levels of permission. 

These compromised accounts enabled cyber criminals to make transactions — and transfer 173,600 Ether and 2.5 million USD Coin (or $600 million altogether).

The attack was discovered after the customers couldn’t withdraw their funds from the Ronin bridge. The company has been investigating the incident and increasing the validation threshold from five to eight. 

To Conclude

What these four major hacking incidents of 2022 have in common is that the users who trusted the company with their data are the ones affected by the incident the most. 

Therefore, properly managing and protecting customer information is essential just as regular management of security solutions and protocols. 

These high-caliber cyber attack cases show us that having security teams and layered tools that major companies rely on doesn’t make businesses immune to cyber attacks - not even basic ones. Tools such as attack surface management are crucial here because they help security professionals in managing an increasing attack surface and pinpoint high-risk threats early.

You Might Also Read: 

Simplicity In Complexity: The Key to Successful Threat Exposure Management:

 

« Ukraine’s Military Intelligence Hit By Cyber Attacks
France Fines Microsoft For Privacy Breaches »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

eSentire

eSentire

eSentire is the authority in Managed Detection and Response Services, protecting the critical data and applications of organizations from known and unknown cyber threats.

Kaspersky Lab

Kaspersky Lab

Kaspersky Lab is one of the world’s largest privately held vendors of endpoint cybersecurity solutions.

International Association for Cryptologic Research (IACR)

International Association for Cryptologic Research (IACR)

(IACR is a non-profit scientific organization whose purpose is to further research in cryptology and related fields.

Cyber Security National Lab (CINI)

Cyber Security National Lab (CINI)

The Cyber Security National Lab brings together Italian academic excellence in Cyber Security research.

CyberSeek

CyberSeek

CyberSeek provides detailed, actionable data about supply and demand in the cybersecurity job market.

Quantum Security

Quantum Security

Quantum's game-changing approach to cybersecurity brings you performance and peace-of-mind, with a raft of additional benefits: it's non-proprietary, comprehensive, scalable, and affordable.

BlueRiSC

BlueRiSC

BlueRiSC invent cutting-edge system assurance solutions for the 21st century with novel software and hardware designs focusing on security technologies that can be game changing.

Active Countermeasures

Active Countermeasures

Active Countermeasures believe in giving back to the security community. We do this through free training, thought leadership, and both open source and affordable commercial tools.

Integrity

Integrity

Integrity is a PCI QSA and ISO 27001 certified company specialized in Information Security and IT Consulting.

Secora Consulting

Secora Consulting

Secora Consulting is a professional services company specialising in tailored cybersecurity assessments and cyber advisory services.

AT&T Cybersecurity

AT&T Cybersecurity

AT&T Cybersecurity’s Edge-to-Edge technologies provide threat intelligence, collaborative defense, security without the seams, and solutions that fit your business.

IT-Schulungen.com / New Elements GmbH

IT-Schulungen.com / New Elements GmbH

Under the name IT-Schulungen.com, the Nuremberg-based New Elements GmbH has been operating one of the largest training centres in the German-speaking world for over 20 years.

Eclypses

Eclypses

Eclypses has a disrupting cyber technology, offering organizations an advanced data security solution called MicroToken Exchange (MTE).

HardTarget

HardTarget

HardTarget is a cutting-edge cyber training company serving HWN (High-Net-Worth) Families and their trusted Advisors.

Operant AI

Operant AI

Operant AI is the only Runtime AI Application Defense Platform that actively protects every layer of live cloud and AI applications from infra to APIs.

Tosibox

Tosibox

Tosibox mission is to Safeguard Critical OT Environments with a Purpose-Built Cybersecurity Platform.