The number of cyberattacks has increased in recent years. Between April 2023 and March 2024, there was an 81% increase, and the types of companies now being targeted aren’t just major corporations. Cybercriminals are going after smaller ones too. They’re also branching out to public sector organisations, including healthcare, government and NGOs. On top of that, they’re escalating in terms of severity, with cyber gangs becoming more aggressive and launching successive attacks more quickly.
We’re only halfway through 2024, but as of May this year there had already been around 20 major attacks. Here are five of the most high profile:
Microsoft
In January, Microsoft announced that a Russian-aligned threat actor stole emails from the company’s senior leadership, cybersecurity and legal teams. Some customers, including US federal agencies, were also affected. The breach is believed to have been due to hackers exploiting a lack of multi-factor authentication on a “legacy” account.
Change Healthcare
This major US healthcare provider disclosed in February that they had been the victim of a ransomware attack which caused massive disruption, as their IT systems were shut down in response. This prevented pharmacies and hospitals from processing claims and receiving payments. In June, the organisation revealed that sensitive patient medical data, including diagnoses, medicines and test results, was also exposed in the attack.
Fujitsu
In March, global IT services provider, Fujitsu, announced that it had been the target of a cyberattack in which personal information may have been stolen. Whilst it reported this to Japan’s Personal Information Protection Commission, it has yet to do this with any other government making the extent of the data breach unclear.
AT&T
Also in March this year, personal data of 73m current or former AT&T customers was leaked on the dark web. This included information such as addresses, social security numbers and pass codes. Whilst the data was shared this year, the breach appears to be from 2019 or earlier. It’s not clear whether the data came from AT&T’s own systems, or from a third-party supplier.
NHS
Another healthcare sector company was targeted in June this year. Pathology services provider to several London-based NHS hospitals, Synnovis, was the victim of double extortion ransomware. As a result of the attack, thousands of appointments and operations had to be cancelled and weeks later the disruption is still being felt. On top of that, when Synnovis refused to pay the ransom, 400GB of patient data was released onto the dark web.
As cybercriminals’ tactics become more sophisticated and more aggressive, it’s crucial that organisations are prepared to both spot potential threats and deal with the fall out in case they are targeted.