Four Major Cyber Attacks In 2022: How To Not Repeat History In 2023

Brought To You By Rene Mulyandari 

Twitter, Medibank, Optus, and Ronin are among the worst cyber crime cases reported in 2022. How can tools such as attack surface management prevent hacking from taking place?

“Those who don’t learn from history are condemned to repeat it.” The field of cybersecurity is not exempt from this saying. Going into 2023, what should you know about the worst cyber attacks that occurred in 2022 and what can we learn from them to avoid repeating history?

Here, we cover attacks and data breaches that affected the users of Twitter, Medibank, Optus, and Ronin.

#1 Twitter

In August 2022, Twitter shared that hackers had exploited a flaw that appeared after a code update in June 2021. The bug was detected and fixed in January 2022 and the company believed no one exploited it at the time. However, in July 2022, Twitter learned that criminals had discovered the bug and misused it to obtain sensitive user information and compromise user accounts.

As a result, 5.4 million user accounts have been compromised in the breach. The data made available for purchase on hacking forums includes user phone numbers and email addresses. The users whose information had been compromised have been notified by the company. Could the exploitation of this zero-day vulnerability have been avoided?

One of the security solutions that companies use to detect, test for vulnerabilities and analyze is attack surface management. 

To pinpoint issues in real-time, attack surface management uses artificial intelligence and automatically tests the entire attack surface against all known and zero-day vulnerabilities.  The data of the testing and analysis is displayed on a single dashboard in a risk-focused report that aids security analysts to prioritize their tasks — focus on the major risks first.

The tool is linked to the resource MITRE ATT&CK Framework which lists new hacking techniques.

#2 Medibank

In November 2022, major Australian health insurer Medibank suffered a cyber attack that gave intruders access to the data of 9.7 million users. The data breach happened after the well-known ransomware group REvil gained access to the company’s systems using the stolen credentials of a user with high privileges.

The attack on Medibank, like many others, was financially motivated. The threat actors demanded a ransom be paid in exchange for not leaking the sensitive medical data they obtained from the insurer.

The company refused to pay the ransom since this action would encourage and finance further criminal activity. Also, there was no guarantee that the sensitive information would be returned or not leaked regardless. As a result, the criminals behind the breach went public with sensitive information such as passport numbers, customer names, birth dates, medical claims, and more.

In November, the threat actors leaked what is believed to be the last 5G of the data that was obtained in the breach. They shared it in a hacking forum. Customers whose information has been revealed on the dark web are susceptible to further criminal activity such as identity theft.

Retaining control over the large amount of data that the company stores in the system is a challenge. So how can you prevent major incidents like this?

Data breach protection includes:

• Regular discovery and patching up of vulnerabilities that might lead to unauthorized access.
• Encouraging users to set up strong passwords and use multi-factor authentication.
• Having solutions that protect against specific attacks such as ransomware.

#3 Optus

In October 2022, another high-profile hacking case hit an Australian company. This time, the victim was the telecom giant, Optus. The data breach compromised the information of 11 million users in one of the worst cyber attacks ever recorded in Australia. The users (current and former ones dating back to 2017) whose sensitive data has been obtained in the breach were notified. The company claims that it stopped the attack as soon as it had been identified in the system.

What caused this data breach?

The company initially claimed that sophisticated hacking was to blame for the breach. Later, it was reported that the threat actor got unauthorized access to the company’s network by exploiting a publicly available API endpoint.

Unprotected APIs leave the company exposed and can grant access to the database without the criminal having to log into the system.

Affected customers are at heightened risk of phishing attacks as well as identity fraud. Namely, the information that has been leaked includes birth dates, Medicare ID numbers, passports, emails, home addresses, and driver’s licenses.

This case is a reminder that even companies that have multiple layers of protection and strong security can suffer a breach if the security is not thorough and leaves basic vulnerabilities to be exploited within the system.

#4 Ronin Network Attack 

In March 2022, the blockchain network known as Ronin suffered a cyberattack that resulted in $600 million in stolen digital assets. It was considered to be the second biggest crypto hack ever. Threat actors behind the attack have been identified as the Lazarus group. They obtained access using the private keys that enabled them to approve several transactions.

How was the attack possible?

Ronin is linked to the game Axie Infinity. The hackers discovered outdated accounts with high levels of permission. 

These compromised accounts enabled cyber criminals to make transactions — and transfer 173,600 Ether and 2.5 million USD Coin (or $600 million altogether).

The attack was discovered after the customers couldn’t withdraw their funds from the Ronin bridge. The company has been investigating the incident and increasing the validation threshold from five to eight. 

To Conclude

What these four major hacking incidents of 2022 have in common is that the users who trusted the company with their data are the ones affected by the incident the most. 

Therefore, properly managing and protecting customer information is essential just as regular management of security solutions and protocols. 

These high-caliber cyber attack cases show us that having security teams and layered tools that major companies rely on doesn’t make businesses immune to cyber attacks - not even basic ones. Tools such as attack surface management are crucial here because they help security professionals in managing an increasing attack surface and pinpoint high-risk threats early.

You Might Also Read: 

Simplicity In Complexity: The Key to Successful Threat Exposure Management: