One of the headline takeaways from the first half of 2020 was that the number of data breaches was down considerably on 2019’s figures. Some estimates suggested a 33% drop in data breaches in the first half of 2020. While that sounds good, it comes loaded with caveats. First of all, there have been lulls before that have not signalled trends lower. Over time, data breach statistics tend to look like stock markets: there are dips and ‘crashes’, but they generally trend up the ways as the year’s pass. Secondly, there is also some evidence that cybercriminals already have the information they need from previous large-scale hacks, and that they can move onto other areas of cybercrime.
But perhaps most interesting of all is the claim of hyper-vigilance on the part of companies. As we saw millions of office workers move to remote working, the warnings were fired by cybersecurity experts – cybercriminals would profit from the fact employees were working outside of the normal safeguards of office security systems. But this didn’t materialise in the way that was predicted, with some experts pointing to a new sense of vigilance by companies overseeing remote working. The idea is that companies could be complacent when surrounded by their office security systems, but re-scrutinised their cybersecurity measures when faced with employees working from home.
Phishing has become much more sophisticated
While the upheaval of the remote working spike did not lead to more data breaches – although, we should point out there is always a reporting lag – we did see a massive increase in phishing. By November 2020, Google reported an increase of almost 20% in phishing websites compared with all of 2019’s figures. Top10.com published a fascinating read on ten steps to protect your data online, and the prevention of phishing was at the very top. It’s one of those cybercrimes that most of us tend to think we are too smart to be caught out by. When we think of phishing, most of us picture badly-worded emails and amateurish presentation that snare only the vulnerable or thoroughly gullible. This is far from reality.
Indeed, the pandemic taught us that cybercriminals are adept at preying on ‘emotions’. Consider how you would feel if, like millions of Americans, you were claiming unemployment benefits for the first time in 2020. Suddenly, you receive an email or text message saying your check was delayed because you did not provide the right social security number; you can update it by clicking the link. That’s the type of emotional strategy used by cybercriminals in phishing attacks, who know full well that people can be confused. Similar warnings have been issued over stimulus checks sent out during the pandemic. In short, we make mistakes when we are worried or confused.
Cryptocurrency was a target in 2020
One study claimed that 50% of cryptocurrency theft was down to De-Fi attacks. De-FI, or decentralized finance, is an umbrella term for a host of applications like decentralized exchanges, Stablecoins, lending platforms, prediction markets – basically the financial market for cryptocurrency. De-Fi attacks often involved flash loans (another area where crypto looks to mimic standard financial commerce) with hackers targeting vulnerabilities in the smart contracts on which the flash loans are executed.
We will probably have to wait until the middle of 2021 to get a better sense of what happened across 2020 in terms of cybercrime. That’s when we will get a look at the Verizon Data Breach Investigations Report, which is still the gold standard in providing analysis and a comprehensive overview of cybercrime in the year beforehand. All too often, stats are published through small surveys by security companies, giving us a misleading sense of what has occurred. The Verizon report should provide us with a clear understanding.
Nevertheless, there have been several trends that seem idiosyncratic to 2020 and the pandemic. Will they continue as vaccine programmes roll out across the globe and as (hopefully) we move away from the pandemic? Some, like the rush to exploit the value of cryptocurrency, will be here to stay. Others, like the drop in data breaches, are much less likely to be sustained.
