The era of hacks and scams: what kinds of security breaches are businesses more susceptible to?

The wave of malicious online activity targeting enterprises intensified during the pandemic. Last year, four in ten businesses reported a breach or an attack, with four in five security incidents occurring due to weak passwords, according to the latest research by Custard.

Cybercriminals are exceptionally selective when it comes to their targets. As such, while companies of all sizes were equally of interest, threat actors preferred to go after employees with access to financial details. 58% of victims worked in the accounts department and received a scam email that had a director named. The rest 42% were randomly dispersed across the board.

The crypto scam was used by threat actors in 72% of the cases that involved email. Victims were forced to pay a ransom in crypto, and considering the irreversible nature of most crypto transactions, it is unlikely that they will get their money back.

“These tend to start with sentences such as ‘you have been recorded on your webcam doing things you shouldn’t’ and proceed to threaten to leak this data to all your contacts if a payment is not made,” the report suggests.

Another popular scam involved email spoofing, with a cybercriminal impersonating a member of the organization. Many of these were sent to account departments in the name of the director, requesting urgent payments. The emails were characterized by their pressing nature, trying to make the victim act on the spot and eliminating the time to assess the situation.

In turn, four in five non-MFA client security breaches occurred due to weak passwords. Through the use of automated robotic networks, threat actors can brute-force their way into a company by trialing common passwords and usernames. This results in the inability to adequately evaluate which information might have been compromised. Another 18% of the breaches happened due to personally targeted emails.

The cybernews investigation team has analyzed 15,212,645,925 passwords and found that the most common ones are:

1. 123456
2. 123456789
3. qwerty
4. password
5. 12345
6. qwerty123
7. 1q2w3e
8. 12345678
9. 111111
10. 1234567890

Make sure to create a complicated password or use a password manager to generate and store secure passwords for you. Furthermore, enable a Multifactor Authentication (MFA) - according to Custard, 90% of targeted companies did not have MFA in place while not a single client that had MFA enabled was targeted repeatedly.