It's the end of the year which brings one of our favorite posts of the year - a time to look back at all the carnage that happened in the cybersecurity space and be thankful we made it through another year unscathed! 2022 has indeed been a tumultuous year, with cybersecurity threats increasing at an alarming rate and many companies struggling to keep up.
It seems with each passing year, an organizations cybersecurity culture becomes more and more important, with businesses of all sizes investing in solutions. Here are some of the major news stories from this past year that had a big impact on cybersecurity worldwide!
Marriott Hotel Faces Data Breach
Marriott Hotels, the hospitality giant, was exploited again after attackers convinced a single hotel employee into turning over credentials for computer access. It is reported that 20 GBs worth of data was exploited, leaking credit card details.
A total of 300-400 individuals are estimated to have been affected. This breach follows the massive breach Marriott faced in 2020 when the personal identifying information of more than 5.2 million loyalty program members was exposed.
Emotet and Trickbot Infections Increase
This past year, there was a sudden resurgence of Emotet and Trickbot infections. While not yet as well known as some others, these banking trojans are real and effective. They typically start with a malicious email attachment, and once the host is compromised, the malware spreads like wildfire across a network.
These infections often drop additional malware including Dridex, another banking trojan, and ultimately ransomware.
Chipmaker AMD Hacked Because of Poor Passwords
Chipmaker AMD recently confirmed that it had been exploited by a criminal organization that claimed to be in possession of stolen data. While the details of the attack are not yet public, it has been reported that part of the reason AMD fell victim to the attack was at least in part, due to the use of unsafe passwords including “password” and “123456”.
Uptick in SocGholish (FakeUpdates) Incidents
A recent uptick in FakeUpdates, or SocGholish, has been observed. In these incidents, the web browser is redirected to a malicious site to trick the user into running a fake update bundle which will then download additional malware. While security solutions can prevent some threats from successfully executing, user education is often the best defense against threats like these that target users for initial access.
Microsoft Office “Follina” RCE Attack
Microsoft suffered a 0-day attack they were eventually able to patch, though not until roughly two weeks after it was identified. This attack featured remote code execution, meaning the attacker can could run code on a device other than their own, seeking to elevate their access privileges and gain uninhibited access to the affected environment. Executing the malicious code was as simple as opening up a Word doc in preview mode.
Baptist Medical Center Falls Victim
The incident at Baptist Medical Center ranks as one of the largest breaches recently tracked by the U.S. Department of Health and Human Services. The breach, discovered in April, included unauthorized access to highly sensitive patient data. Information compromised in the breach included:
- Full name, date of birth, and address
- Social Security number
- Health insurance information, such as the name of the insurer and the policy and/or group number
- Medical information, such as medical record numbers, dates of service, provider and facility names, chief complaint or reason for a visit, and other visit procedure and diagnosis information
- Billing and claims information, such as account and claim status, billing and diagnostic codes
Common Cyber Mistakes to Avoid
To help prevent cybersecurity incidents, here are some common cybersecurity mistakes to avoid:
- Neglecting patch management
- Reusing passwords
- Not using two-factor authentication
- Not regularly backing up data
- Not assessing cybersecurity risks
By being aware of these common cybersecurity mistakes and taking necessary precautions, you can help protect your organization from future breaches and other cyber attacks.
Enjoy the Holidays!
Despite the negative cybersecurity news, there is still hope for you this holiday season! As you take the necessary cybersecurity precautions and stay vigilant, make sure to also enjoy some family time and indulge in your favorite holiday activities. Happy Holidays!
