Biggest Security Breaches in Australia for 2021 and what to expect in 2022

From analyzing some of the biggest attacks Australia has faced this year it is evident that there is a heavy target on critical infrastructure and services provided to the public. Specifically, services providing healthcare and government aid.

Hackers had control of several water system servers for 9 months, redirecting traffic and uploading malicious content. It was also discovered that there were numerous “control weaknesses” within the system. It was discovered that the threat actors were targeting parts of their system that still had legacy version running. Read More...

4 hospitals have been victims to a ransomware attack resulting in the loss of access to patient files and medical history. Several internal systems went down, and non-critical surgeries were postponed until the breach was rectified. Action taken by the IT department disrupted hospital function even more by cutting access to systems and employee emails while they continued their investigation. Read More...

JBS Foods, A global meat company were infiltrated by a gang of cyber criminals demanding ransomware, impacting the Australian meat supply. After 5 days of being compromised the companied paid 14.2 million dollars to end the attack. Read More...

Health and identity related data of patients was leaked to hackers. The hackers were able to steal data from an Accellion vulnerability. NSW health uses the Accellion software for their file sharing. This is not the first Accellion vulnerable our health sector have come across, with Queensland Medical Research Institute also being subject to a breach through Accellion software in December 2020. Read More...

The Tasmanian Ambulance Phone services were being monitored for months with personal details about the callers being uploaded by a hacker online. The cause of this was the Tasmanian ambulance services were using outdated technology to manage their calls. Read More...

Majority of the other attacks and exploited vulnerabilities were observed to be targeting companies that provide services to a large percentage of the global population.

Facebook were compromised by adversaries resulting in millions of user data being leaked. It has been estimated that 533million Facebook users were victims to the breach, with information such as phone numbers, name, address, email, birthday, and more being taken. The adversaries used a known vulnerability on the website from a bug that was first identified back in 2019. Read More...

Being one of the largest technologies companies in the world Microsoft is no stranger to being a target. A vulnerability was identified on the Microsoft Emailing server resulting in hackers having the ability to wipe computers, install backdoors and ransomware and sift through users’ emails. This vulnerability was mainly used to target business and corporations. Read More...

Hackers were able to leak sensitive personally information of streamers and users through a server configuration error. Data found in this leak include encrypted passwords, unreleased content, payout information and potentially more as the breach is further investigated. Read More...

700million LinkedIn users’ data was found for sale on an online hacking forum. The data for sale contained job information, usernames, emails, birthdays, addresses and more. Hackers potentially exploited a vulnerability in the LinkedIn API, which is used to collect and manage user data and posts. Read More...

the intent behind these attacks is not necessarily targeting the provider but to use a vulnerability in a provider to exploit businesses and users. Take for example the Facebook hack in February 2021. If the attacker’s intention was to target Facebook, the company has the resources and capital to fight back. However, using the companies’ vulnerabilities against the users can result in getting away with crimes such as stealing user information or uploading malware to their devices. If this goes undetected the individual victims often don’t have the resources and capital to fight or even detect the crime being committed.

From comparing the ACSC annual cyber reports over the last two years it is evident that cyber-attacks in Australia are increasing each year. The 2019-2020 FY report states that 59,806 cases of cyber crime were reported to the ACSC. The 2020-2021 FY reports statistics show an increase of approximately 13% in just one year, with 67500 reports. Keep in mind these are only known and reported events, with many attackers getting away with not being discovered. Many smaller companies and individuals often don’t report these events to the ACSC as well, resulting in the real figures potentially being significantly higher. The report also states that businesses and individuals have incurred over $33 billion in loss from cybercrime over the past FY. This is the sum from ransomware payouts, replacing goods damaged or loss in the incidents, paying out customers for being affected, uplifting their cyber security posture and more. Australia has one of the highest percentages of payouts to ransomware companies in the world. According to the annual ACSC report this FY a growth of 15% in ransomware attacks from previous years.

Our worlds digital space is widely consumed by a younger audience, with children as young as 9 nowadays being active on social media platforms and gaming applications. This inflates the audience for cyber criminals to perform lower-level scams targeting these younger audiences. With scams like these it is difficult to escalate the issue. This is a result of:

With more and more data leaks occurring nowadays, such as the LinkedIn and Facebook hacks earlier in the year, attacks such as password spraying and brute forcing using the credentials from these links will increase. The focus of these attacks is predicted to target small businesses as they often won’t have the same level of security measures in place compared to larger corporations. This is also due to small businesses having a newer presence to the web as a result of the covid-19 pandemic pushing them online.

The covid pandemic has brought into light working from home as a common practice nowadays despite being able to work back in an office. Again, this has expanded the attack surface for cyber criminals now pivoting towards a new focus on BYOD and remote workers to gain access and traverse through to the company. The growth of AI driven devices and applications being tasked with more critical roles such as driving a car again opens a door to a whole new field for criminals to target. As robot ethics come into play and AI is given more and more control other tasks, if an attacker can infiltrate or change the behavior it could lead to much more fatal damage i.e., changing the behavior of a car from “avoid other cars” to “crash into other cars”. The speed at which AI is developing poses the question can our cyber security knowledge keep up with this growth? What if it develops to a point where AI will become our enemy? Will they or could the advance to a cognitive point where we simply don’t have control?