Top Security Breach Cases of 2015

With an average cost of $3.5 million worth of corporate data lost due to data breaches, the importance of having a secure IT infrastructure is becoming more urgent than ever.

The damage brought about by cyber attacks has a major impact not only on company finances and reputation,  but on time lost during the disaster recovery period as well. This is because, in 31% of security incidents, the average downtime or stoppage of operations clocked in at more than 8 hours on average.

While data breaches can be costly, and the damage considerable, studies show that companies practicing strict security procedures and methods on their IT systems can reduce the cost by as much as $14 per incident.

Here are five of the most high-profile security breaches of the year, and what we can learn from these incidents to prevent further attacks in the future.

 

1. Harvard University and Other Organizations in the Education Sectors

The prestigious university was not immune to cyber attacks. It is only one of eight other education breaches reported in 2015 involving schools and administrative offices—compromising school log-ins in Harvard, and a total of about 20,000 records across other schools throughout the United States.

Universities are considered as smaller targets compared to the millions of records of large-scale breaches that the health, finance, and large retail industries have fallen victim to in recent years. Nevertheless, several factors make schools and universities more vulnerable to hackers compared to other sectors.

First, the educations sector strives in an open culture of free-flowing exchange of ideas, where tight security is not given priority. Which leads to the second factor, where openness also means that a smaller budget is allocated to security. Lastly, studies show that this sector is far more likely to visit malicious websites and fall victim to spyware and adware.

Further, attacks can be prevented by implementing best practices proven successful in other industries including executive support, more stringent measures for monitoring, and widespread awareness. IT systems also need to be kept up-to-date, and systems audits must be conducted on a regular basis.

 

2. Duqu 2.0 Attack on Security Vendor Kaspersky Lab

Kaspersky Lab is a Moscow-based security vendor whose system was compromised by a highly sophisticated new malware platform called Duqu 2.0. It is said to be a nation-state sponsored attack, which appeared to have targeted places with links to world power meetings that include negotiations for an Iran nuclear deal and the 70th anniversary of the liberation of Auschwitz-Birkenau.

This attack on Kaspersky Lab illustrates just how powerful today’s malware has become. It goes to show that even a company selling security against these types of breaches can also fall victim. The malware was very hard to detect and required several rounds of testing before it was found.

Since the attack, Kaspersky Lab has taken the necessary steps to protect its clients and partners that rely on its system. Moving forward, the company suggests that the latest security products must be installed in the system, including computers, proxies, and servers. Furthermore, Windows must be updated, computers must be rebooted, and passwords should be changed.

 

3. Attack on US Office of Personnel Management

This federal agency was attacked twice in this year alone. The first took place in April, where 4.2 million records of personnel data were compromised while the second one happened a month later—exposing 21.5 million personnel records of federal employees. Sensitive data such as social security numbers, employment history and background checks, including fingerprint information.

The incident compelled the agency to make major decisions, as regards their security policies. It has also affected leadership at the OPM, where Office of Personnel Management Director Katherine Archuleta was compelled to resign—prompting experts to say that the incident is a wake-up call for federal agencies to take cyber security seriously, and do the necessary steps to avoid further attacks.

There is now a clamor for tighter security measures to be implemented, and to put more financial muscle behind creating a more updated IT infrastructure that can withstand malware and similar security breaches.

 

4. Cyber Theft of World Wide Banking Systems

More than 100 banks from 30 countries had their IT systems compromised, where cybercriminals from Eastern Europe managed to instigate fraudulent ATM and money transfers that cost a total of $1 billion. This took over a span of two years, where perpetrators gained access to confidential employee information and bank networks so as not to raise suspicions until it is too late.

To prevent these types of attacks, security experts suggest that organizations make use of capabilities that can inspect and monitor encrypted information because most malware utilizes encrypted communications or an SSH backdoor to give and receive instructions with criminals behind remote servers.

 

5. Health Care Provider Mega Breach

Premera BlueCross BlueShield was the victim of a security breach that affected 11.2 million clients, business partners, and subscribers. Personal data such as social security numbers, bank information, names, and home addresses were exposed.

The sad part is that this scenario could have been avoided, as federal auditors had previously warned the health insurance company that it had a weak IT infrastructure and that the flaws in its system made it vulnerable to attacks.

Taking the time to ramp up your security policies and  engaging experts can be very beneficial for you.

Allowing these experts to oversee your organization’s IT infrastructure will pay dividends in the future. You will be assured that specialists are a step ahead of any incidents that might compromise your company data and that security breaches will most likely occur less often.

In many cases, company-wide awareness and consistent vigilance will increase the likelihood that data breaches can be avoided altogether.