The worst cybersecurity attacks from 2022
Posted on January 27, 2023 by Voke Augoye
If 2022 has taught organisations and businesses anything, it’s that cybersecurity attacks, breaches and leaked confidential data are incredibly costly. Leading into 2023, it’s clear the financial and reputational repercussions must be avoided through strengthened cybersecurity systems and a faultless human firewall.
From political gain to reputation damage, the worst cybersecurity attacks from 2022 left a wake of devastation. Whilst hundreds of thousands suffered due to poor cybersecurity choices from businesses and organisations, others took a stand, having utilised previous cyberattacks as a learning curve.
So, what were some of the worst cybersecurity attacks from 2022, and how did this impact the organisations, countries and customers hit?
What are the worst cybersecurity attacks from 2022?
1. Cyberattacks on Ukraine
In the early part of 2022, Russia was gearing up for its invasion of Ukraine. As well as depleting infrastructure, Russian authorities targeted dozens of websites hosted by Ukraine’s government forcing many offline for hours. The first cybersecurity attack took place on 14th January, causing disruption to 70 websites, with a second attack on 15th February that saw multiple government and bank services as the target.
As cybersecurity attacks happen for a plethora of reasons, such as financial gain and spying, it’s clear that this one was to completely halt and disrupt daily life for Ukrainian citizens, reminding them of a threatening neighbour with political motivations. Through successful cybersecurity attacks, aggressors are able to adjust political narratives and spread dangerous propaganda amongst civilians. As documented in Russia’s own dictation of news media and stories, it aimed to sway public opinion so it could control the information shared with the public.
Historically, Russia committed cyberattacks against Ukraine in the hope of damaging infrastructure and destroying data. As well as government services, the media and telecom providers were all victimised by Russian-led attacks in order to affect and disturb everyday life in Ukraine.
Unfortunately for Russia, its predictability meant Ukraine was more prepared for the cybersecurity attacks than Russia had planned. After 2014, cybersecurity protocols were put in place that ensured a speedier reaction to reduced public and national services. Additionally, a unanimous response from countries allying with Ukraine enabled far less disruption than Russia had predicted. This was also apparent when Russia attempted its most significant attack on Viasat Inc’s KA-SAT satellite, which ended without success.
Russia’s war in Ukraine has caused unparalleled disruption and destruction, but aside from targeting physical infrastructure, there are some instantaneous gains, not limited to reputation damage, where cyber warfare is concerned.
2. Costa Rica ransomware cyberattack
Another victim of pro-Russian aggression, on 17th April over 30 institutions in Costa Rica experienced a malicious ransomware attack. The information hijacked by Conti, ransomware believed to be of Russian origin, was held at ransom, with the threat to release any stolen and sensitive information into the public eye. For Costa Rican citizens, this could include tax returns and personal details.
Demanding $10 million US dollars, cybercriminals managed to steal information from institutions such as the Ministry of Finance and the Ministry of Science. Unwilling to negotiate, the Costa Rican Government had to be immediately reactive by shutting down major computer systems and important digital infrastructures in order to protect the information. This came at a loss of $30 million per day.
Enlisting support from various countries, as well as Microsoft, Costa Rica was forced to declare the hijacking a national emergency. In fact, Conti had been relentless with its attacks, conducting one every day for almost three weeks. Whilst financial gain and extortion was probably a motivator for the group, the sheer disruption caused meant millions of dollars were lost for Costa Rica. It was also problematic for regular health check-ups or accessing money from a bank as healthcare systems and digital bank infrastructure had to be taken offline. This was likely to also affect political persuasions and incite riots or violence.
In this instance, many businesses targeted were not considered cybersecurity aware. Some institutions didn’t have enough resources to tackle the issues, whereas others had no cybersecurity defences. Their vulnerability caused them to be easy, penetrable targets for the group.
3. International Committee of the Red Cross (ICRC) data leak
At the start of 2022, the ICRC fell victim to a significant cybersecurity attack. Data for the most vulnerable people had been compromised and targeted by an unknown entity. The most worrying part for the ICRC was that the attack started in November 2021 and had been left undetected by anti-virus and anti-malware software for around 70 days.
Unlike the Costa Rican ransomware attack, the ICRC experienced no communication with its hackers and did not receive any ransom requests for money. It’s believed that charities may, unfortunately, be easy targets for hackers looking to steal and leak information. In this instance, firewalls and systems were penetrated due to a flaw in a password reset management programme which gave hackers access to sensitive data.
In total, around 515,000 vulnerable people had their data exposed. Victims were all part of a family reunion scheme after individuals had suffered severe violence, war, natural disasters or issues with migration. The scheme was devised to bring families back together and reunite displaced loved ones. Unfortunately, the data held came from over 60 Red Cross and Red Crescent national societies worldwide.
The motivation of cybercriminals still remains unclear. Accessing thousands of personal details immediately compromises vulnerable, possibly displaced, people around the world. However, there’s no indication that any of the data or information has been shared, and no entity has acknowledged the attack.
4. Zero-day Twitter hack
It’s looking as though the zero-day hack that impacted around 5 million Twitter users could actually exceed that figure, as 20 million have more likely been affected. Amongst some of the most concerned were those operating under pseudonyms, which could have involved the likes of closeted LGBTQ individuals to children preferring to keep their identity secret. The ramifications of this information being leaked had the potential to be life-changing.
With notorious, high-profile figures involved with the social media site, such as Elon Musk and Donald Trump, it’s hard to tell whether cyber espionage might also have been a motivator. However, it has since been confirmed that a database of over 5 million Twitter user records had been posted for $30,000 US dollars back in July. As of November, the database became free.
Due to a vulnerability in an application programming interface, hackers were able to retrieve information from the social media platform. The data was made up of both public and private domain information. For example, those affected will have their Twitter handle, name and verification status on show – all details that would normally be available on Twitter. This is then accompanied by private information, including telephone numbers and email addresses.
Although it’s easy to pinpoint faults and flaws with Twitter’s bug-fixing programmes and security software, it’s equally as important for users to register the level of risk that social media presents. In the UK alone, we have a 90.02% social media penetration rate compared with 53.6% globally. Having greater cybersecurity awareness should give users the onus to navigate platforms with a little more caution.
5. Revolut cyberattack and data breach
For financial gain and, also, the destruction of reputation, banking services are high-profile targets for cybercriminals. In September 2022, Revolut discovered that a portion, approximately 0.16%, of its customer base had been subject to a malicious cyberattack. Hackers were able to access tens of thousands of customer records, including banking details and personal information.
Between Sunday and Monday, prior to the cyberattack being discovered, hackers were able to compromise thousands of pieces of data worldwide. Whilst 0.16% seems barely impactful, it amounted to around 50,000 service users across the globe. In the wake of the attack, Revolut and other bodies sent out advice to anyone who suspected their data had been breached.
According to reports, the attack took place through social engineering methods, such as phishing scams or password sharing. It’s not clear the exact method used to penetrate the banking records. Unsurprisingly, human error can lead to disastrous consequences, especially where regular awareness training is not implemented.
Again, there is an onus on the bank and its staff to ensure that an effective human firewall is in place. As well as solidifying digital infrastructure, it also imprints information and awareness on those working within an environment that houses incredibly valuable, but sensitive, data.
How are cybersecurity attacks evolving?
Cybercriminals might be motivated by different means, but their methods are the same – to infiltrate systems and compromise data. It’s an easy task to dismiss cybersecurity risks and consider they might not happen to you or your business, but this blog has already indicated that millions were affected in 2022 alone.
Although the methods may be the same, the threats are constantly changing. Cybercriminals are able to bypass regular security features simply through one email. Their aims can be to access personal data for the purpose of blackmail and even to hack into confidential files belonging to a business, More sophisticated groups can penetrate security software that has undetected weak patches. Whether they are after financial gain through ransom or are set to destroy your organisation’s reputation, as soon as they infiltrate your systems you are at their mercy.
Cybersecurity attacks are also not exclusive to large corporations or governments, they can affect and target every one of us. As the online space continues to evolve and expand, cyber scams, espionage and data breaches become more and more advanced.
Cybercriminals are clever, it’s time to be aware
At ramsac, we can support your business by implementing cybersecurity and awareness measures that are designed to keep your organisation safe. Our Cyber Resilience Certification allows you to assess and understand your organisation’s risks whilst strengthening and demonstrating protection to your customers and stakeholders.
