Some cyber security breaches from 2023 and before

You have two choices before you turn in for the night: you can rest easy knowing you’ve taken proactive steps to mitigate cyber threats in your organization, or you can sleep just as soundly, oblivious to the cyber dangers that are so subtle and pervasive, they often go unnoticed until it’s too late.

Before we turn off the lights, let’s shine a spotlight on some of our “favorite” cyber security breaches from 2023 and before. These incidents aren’t just tales of caution; they’re real-life examples of how close and consequential cyber threats can be.

Here’s our top 10:

1. British Airways – names, payment card data, addresses, and email addresses of up to 500,000 customers were stolen by hackers. Cost of it? £20m fine and around £800m in damages.
2. Facebook and Google – trusting fake emailed invoices was pricey as hackers swindled $100 million from these companies. It seems that even giants fall before phishing attacks.
3. BBC – used payroll accounting software MOVEit was hacked and data of 100,000 employees was stolen. This company may have paid the ransom and regulatory investigation is ongoing. Sometimes your supplier’s problem is your problem too.
4. Lithuanian car-sharing service provider CityBee has learned the importance of responsible backup management the hard way. Irresponsibly managed backup copies of customer data were placed in publicly accessible repositories. As a result, it led to unauthorized access and leak of such data. The company was fined EUR 110,000 and suffered reputational damage.
5. In 2022, BankingLab, a developer of banking systems, experienced a cyber-attack that led to the leaked personal data of their clients. The incident happened because the company had protected its infrastructure with non-up-to-date applications. Such weak link was perfectly exploited by malicious actors to breach the confidentiality of their systems and stored data. Therefore, the investigation may still be ongoing so it may lead to even more serious consequences.
6. DDoS (Distributed Denial of Service) attacks are a common way to disrupt business availability and day-to-day operations. In 2023, the Lithuanian company Linas Agro experienced a DDoS attack that disrupted its website and access to the systems available there. It goes without saying that disrupting the availability of business-critical functions can have tragic commercial and reputational consequences.
7. Even large companies with a strong talent pool may fall prey to social engineering attacks. In 2022, a Revolut employee was tricked into providing access to their systems to a malicious actor. This was achieved by using social engineering techniques and earning trust of the employee. It led to the leak of 50,150 customers’ personal data and operational disruptions of the company’s activities. Moreover, if the investigation of this incident is still pending, it may lead to more consequences.
8. In 2023, a publicly-known Lithuanian military officer suffered a severe attack on his Facebook profile. Even multi-factor authentication via SMS was not effective, and malicious actors were able to gain access to his profile and post a lot of inappropriate content. This situation is a reminder that it is best to use specific multi-factor authentication applications in all cases.
9. In 2022, Uber employees received a Slack message from an unknown user, stating “I am a hacker.” The message alerted them to a data breach that happened days before. After the criminal purchased an Uber contractor’s credentials, they tried to log in. However, multi-factor authentication was turned on, but hackers started harassing contractor with fake multi-factor authentication push notifications. Once he gave into such requests – the criminals broke into Uber’s network and accessed sensitive information from the company’s SaaS accounts. This is a good reminder that inherently secure SaaS applications are not completely immune to external intruders, and that the companies using them need to take extra precautions.
10. In the summer of 2023, two cyber incidents related to music streaming occurred in Lithuania. One incident took place at a regional radio station and the other at a shopping center. Both incidents disrupted a third-party online music streaming service by replacing the original playlist with disinformation. While SaaS applications are often very secure, it was a good reminder that standard settings are not enough and that it is always necessary to set the most secure settings before using applications.

Most CxOs do not care (or care to little) about real cyber security until is too late. We aim to change that by increasing cyber awareness and developing affordable security solutions for every company.