As the internet continues to expand, keeping up with its transformation has become increasingly challenging. The constant need to adapt to technological advances has exposed organisations to听data breaches and cyber-attacks where cyber criminals primarily target them for financial gain 鈥� and sometimes political reasons 鈥� where their aim is to extort and ransom their victims for profit.
But when domain and hosting providers Fasthosts听released their听State Of The Web听report, which revealed that 11% of Brits don’t use the internet out of fear for their online safety, they were keen to understand why.
颁辞耻苍迟濒别蝉蝉听听have come to light in 2023, and we鈥檙e only halfway through. These have affected hundreds of organisations operating in different sectors across the UK, from small businesses to听large听corporations, and from the private to public sectors. But who鈥檚 most at risk?听Fasthosts听has compiled the most notable听breaches听from 2023 (so far), and the three industries currently most at risk.
Business
In the 2023 cyber security听breaches听survey听released by the British government, it was estimated that across all UK businesses, approximately 2.39 million instances of cyber crime and around 49,000 instances of fraud (as a result of cyber crime) took place in the last 12 months.
Starting off the new year the听wrong听way was Twitter. On January 5th, the email addresses tied to over 235 million accounts 鈥� almost half of Twitter鈥檚 user base 鈥� were posted to an online hacking forum. Described as one of the most significant听leaks听ever seen, users have been warned that as a result of the hack, they could become victims of hacking, targeted phishing, and doxxing. Not the news you want to hear.
On January 8th, Yum! Brands 鈥� the parent company of KFC, Pizza Hut, and Taco Bell 鈥� were at the receiving end of a cyber attack. In fact, they were forced to close over 300 UK restaurants in order to contain the incident, which听involved a threat actor gaining unauthorised access to Yum! Brands鈥� network.听Although they proclaimed that there was no evidence of identity theft or fraud, they made everyone involved aware that they could have been subject to the loss of information such as names, driver鈥檚 licence numbers, ID numbers, and other personal identifiers.
In January, PayPal was made to send out听data听breach听notifications to just under 35,000 users who had their personal听data听exposed. The attack involved credential stuffing 鈥� the act of using the login credentials collected from a听data听breach听from a separate service provider to attempt to login to a different service听鈥� to access the accounts. Although PayPal itself wasn’t听breached, as an online payment system, the consequences of a听breached听account could be catastrophic.
At the end of January, sportswear retailer JD Sports became another cyber victim. The company revealed that information such as name, billing and delivery address, phone numbers, order details, and the last 4 digits of card details were leaked for approximately 10 million customers. The attack also targeted the purchases from their partner companies including听Size?, Blacks, Scotts, and Millets.
The Zellis听data听hack involved a chain system affecting multiple parties. Hackers originally found a weakness in MOVEit, a file sharing system that payroll provider Zellis uses alongside their clients. The information that was stolen related to employees of eight of their听largest听clients, including BBC, Boots, British Airways, and Aer Lingus.
Education
As cyber attacks on the educational sector rise, the latest cyber security听breaches听survey 2023 revealed that all types of education institutions are more likely to have identified cyber security听breaches听or attacks in the last 12 months than the average UK business.
In January, it surfaced that 14 UK schools were hit by a cyber attack supposedly revealing 500GB worth of highly confidential听data, including SEN information, child passport scans, staff pay scales, and contract details. The hack was reportedly orchestrated by Russian hacker group, Vice Society, who have been targeting public schools across the world, and most recently the UK in late 2022. They鈥檙e known to acquire sensitive information to use for double extortion purposes (a ransomware tactic used to ask for money in exchange for the decryption or deletion of听data).
This time targeting the higher-education sector, one of the most recent victims is the University of Manchester, who revealed that they were victims of a cyber attack at the beginning of June. They are still currently unsure as to听what听data听has been accessed, but believe that听data听is likely to have been copied, as the orchestrator of the attack accessed their systems and threatened the institution with a 鈥榣ast warning鈥� before releasing the听data听from their 40,000 students and 12,000 staff.
Government
New听research听has revealed that nearly eight in 10 providers of frontline healthcare services within the UK have experienced at least one听data听breach听since 2021.
Around 90 separate organisations have reported听breaches听of personal information held by听Capita听after the payroll outsourcing group suffered a cyber attack. This caused听major听IT outages for clients, some of which ran crucial services for the NHS, local councils and the military. Capita employs over 50,000 people in the UK and holds 拢6.5bn worth of public sector contracts with the British government.
On the back of the University of Manchester听data听breach, a new report has surfaced suggesting that the听data听from over one million NHS patients may have been compromised from the NHS听data听used for 鈥榬esearch purposes鈥� that was leaked in the University’s recent听data听breach. Some of the reportedly stolen听data听includes NHS numbers and the first three letters of patients鈥� postcodes.
The听breaches听listed here don鈥檛 even begin to scratch the surface of what鈥檚 happened in the digital world so far this year. As we are becoming increasingly reliant on digital technologies, learning how to manage the potential threats and vulnerabilities is an uphill battle. Tackling these threats involves a collective effort, combining new risk management framework, and educating businesses, staff, and individuals on practising strong internet safety to enhance their defences.
