By Alex Pinto, Lead author of the Verizon Business 2020 Data Breach Investigations Report
Since we launched the Verizon Business 2020 Data Breach Investigations Report (2020 DBIR) in May 2020, we have seen the COVID-19 pandemic deliver additional security challenges to businesses around the globe. We have seen organizations quickly move their workforces en-mass to remote working; e-commerce has increased, with many industries – and especially retail and food services now relying more heavily on their online presence and cloud-based workflows; and health providers have also moved to online service delivery, to name just a few industries the pandemic has impacted.
Unfortunately, in these times of rapid change and confusion, cybercriminals have been watching and looking to capitalize on any opportunity for financial gain. In order to shed light on the increasing number of threat actors worrying cyber security specialists, our renowned DBIR team has generated a three-month analysis – entitled “Analyzing the COVID-19 data breach landscape” – which brings these threats under the spotlight.
Unlike our DBIR series, this study focuses on 36 confirmed data breaches which were identified as being related directly to the COVID-19 pandemic, and also reviews 474 data breach incidents from March – June 2020 based on contributor data and publicly disclosed incidents. We have combined this data with our own team’s observations drawn from our collective years of experience to ascertain the cyber-trends that have most impacted businesses during this time.
Focusing on the tried and tested amidst the confusion
Pre-COVID-19, cybercriminals were successfully using tried and tested methods to obtain data. It goes without saying that if these tactics worked in a stable business environment, they have been working even better in an era of unprecedented disruption. Criminals are ultimately lazy in their approaches and, faced with a larger attack surface than usual during the pandemic, there has been no need to invent new attack strategies to achieve their goals.
Based on our observations we have seen the use of these common threat actors increase:
Continued increase in errors: Human error is often seen as a major cause of security incidents – in fact we reported that nearly a quarter of the breaches analysed in our 2020 DBIR were due to this. Faced with major disruption, increased workloads as a result of decreased workforces, and of course, for many, the distraction of in-house family members and home-schooling, there is no wonder that more errors have been reported during the pandemic.
Focus on stolen credential-related hacking: Our 2020 DBIR flagged that over 80 percent of breaches were caused by stolen or brute-forced credentials. This has now been exacerbated by the large number of employees working from home requiring ongoing remote access and workstation maintenance. Business IT departments are being challenged to secure company assets on the corporate network while the majority of the workforce is out of the office. This has widened the number of remote targets for cybercriminals to target.
Use of ransomware is spiking: We saw that several incidents reviewed within the COVID-19 dataset involved the use of ransomware. These involved the copying and posting of data (either partially or entirely) publicly online. Of the nine malware incidents in the COVID-19 dataset, seven were confirmed breaches demonstrating a spike in ransomware usage.
Phishing emails play on emotions: Phishing has always been a popular cybercrime tactic. Prior to COVID-19 we flagged that credential theft and social attacks such as phishing and business email compromises were at the root of the majority of breaches (over 67 percent). Combine this attack success with uncertainty, fear and the need for COVID-19 information, then you will understand why phishing emails containing the words “COVID” or “CORONAVIRUS, “masks”, “test”, “quarantine” and “vaccine” were found to be widely used within this time period. We saw phishing emails unrelated to COVID-19 had a slightly lower click rate (with a median of 3.1 percent).
The phishing emails that were linked to COVID-19 had a somewhat higher median at 4.1 percent and showed more organizations having far higher click rates – over 50 percent in some cases. A phishing simulation performed on approximately 16,000 people in late March (the early weeks of shelter-in-place for many states in the USA) found that almost three times as many people not only clicked on the phishing link, but also provided their credentials to the simulated login page than in pre-COVID-19 tests late last year. This heightened emotional response is completely understandable when COVID-19-related terms are involved and are being exploited by cybercriminals.
Comprehensive security strategies can help steer in these unchartered waters
Businesses around the globe have continued to focus on serving their employees and customers as a priority throughout the pandemic. Armed with insights into the evolving tactics used by cybercriminals during this period and comprehensive security strategies – such as managed security services, identity solutions and most importantly on-going employee education – we can set a more productive course to help create a more secure business environment and maintain business momentum.