The number of cyberattacks doubled in 2017, with ransomware leading the way.
That’s according to the Online Trust Alliance (OTA), which has named 2017 “the worst year ever in data breaches and cyber-incidents around the world.”
OTA’s Cyber Incident & Breach Trends Report found that skyrocketing ransomware usage resulted in 160,000 cyberattacks. That’s nearly doubled from 82,000 in 2016. And since the majority of cyber-incidents are never reported, the actual number in 2017 could easily exceed 350,000, the firm estimated.
Of those, there were 134,000 ransomware attacks on businesses, nearly doubling that of 2016. In mid-2017 another type of ransomware attack emerged—the ransom denial-of-service (RDoS) attack. In this attack, criminals send an email to domain owners threatening a distributed denial-of-service (DDoS) attack that will make a website inoperable unless a ransom (usually via Bitcoin) is paid.
“Surprising no one, 2017 marked another ‘worst year ever’ in data breaches and cyber-incidents around the world,” said Jeff Wilbur, director of the OTA initiative at the Internet Society. “This year’s big increase in cyberattacks can be attributed to the skyrocketing instances of ransomware and the bold new methods of criminals using this attack.”
In the report, OTA analyzes data breaches, ransomware targeting businesses, business email compromise (BEC), DDoS attacks, and takeover of critical infrastructure and physical systems over the course of a year, using data from its members.
It also concluded that 93% of breaches could have been avoided had simple steps been taken, such as regularly updating software, blocking fake email messages by using email authentication and training people to recognize phishing attacks.
Of the reported breaches in 2017, OTA found that 52% were the result of actual hacks, 15% were due to lack of proper security software, 11% were due to physical skimming of credit cards, 11% were due to a lack of internal controls preventing employees’ negligent or malicious actions and 8% were due to phishing attacks.
“Regular patching has always been a best practice, and neglecting it is a known cause of many breaches, but this received special attention in 2017 in light of the Equifax breach,” said Wilbur. “In 2018 we expect patches to play an even more integral role due to the recently discovered Spectre and Meltdown vulnerabilities, where nearly every computer chip manufactured in the last 20 years was found to contain fundamental security flaws.”