Since we launched the Verizon Business 2020 Data Breach Investigations Report (2020 DBIR) in May 2020, we have seen the COVID-19 pandemic deliver additional security challenges to businesses around the globe. We have seen organizations quickly move their workforces en-mass to remote working; e-commerce has increased, with many industries – and especially retail and food services now relying more heavily on their online presence and cloud-based workflows; and health providers have also moved to online service delivery, to name just a few industries the pandemic has impacted, writes Alex Pinto, Lead author of the Verizon Business 2020 Data Breach Investigations Report

Unfortunately, in these times of rapid change and confusion, cybercriminals have been watching and looking to capitalize on any opportunity for financial gain. In order to shed light on the increasing number of threat actors worrying cybersecurity specialists, our renowned DBIR team has generated a three-month analysis – entitled “Analyzing the COVID-19 data breach landscape” – which brings these threats under the spotlight.

Also Read: The Digital Ecosystem Needs a Legal Framework for Governance: Ravi Shankar Prasad

Unlike our DBIR series, this study focuses on 36 confirmed data breaches which were identified as being related directly to the COVID-19 pandemic, and also reviews 474 data breach incidents from March – June 2020 based on contributor data and publicly disclosed incidents. We have combined this data with our own team’s observations drawn from our collective years of experience to ascertain the cyber-trends that have most impacted businesses during this time.

Also Read: Verizon to accelerate IoT solution creation & deployment with Microsoft Azure

Focusing on the tried and tested amidst the confusion

Pre-COVID-19, cybercriminals were successfully using tried and tested methods to obtain data. It goes without saying that if these tactics worked in a stable business environment, they have been working even better in an era of unprecedented disruption. Criminals are ultimately lazy in their approaches and, faced with a larger attack surface than usual during the pandemic, there has been no need to invent new attack strategies to achieve their goals.

Based on our observations we have seen the use of these common threat actors increase:

  • Continued increase in error: Human error is often seen as a major cause of security incidents – in fact we reported that nearly a quarter of the breaches analysed in our 2020 DBIR were due to this. Faced with major disruption, increased workloads as a result of decreased workforces, and of course, for many, the distraction of in-house family members and home-schooling, there is no wonder that more errors have been reported during the pandemic.

  • Focus on stolen credential-related hacking:  Our 2020 DBIR flagged that over 80 percent of breaches were caused by stolen or brute-forced credentials. This has now been exacerbated by the large number of employees working from home requiring ongoing remote access and workstation maintenance. Business IT departments are being challenged to secure company assets on the corporate network while the majority of the workforce is out of the office. This has widened the number of remote targets for cybercriminals to target.

  • Use of ransomware is spiking: We saw that several incidents reviewed within the COVID-19 dataset involved the use of ransomware. These involved the copying and posting of data (either partially or entirely) publicly online. Of the nine malware incidents in the COVID-19 dataset, seven were confirmed breaches demonstrating a spike in ransomware usage.

Also Read: Verizon will help customers and small businesses disrupted by COVID19 impact

  • Phishing emails play on emotions: Phishing has always been a popular cybercrime tactic. Prior to COVID-19 we flagged that credential theft and social attacks such as phishing and business email compromises were at the root of the majority of breaches (over 67 percent). Combine this attack success with uncertainty, fear and the need for COVID-19 information, then you will understand why phishing emails containing the words “COVID” or “CORONAVIRUS, “masks”, “test”, “quarantine” and “vaccine” were found to be widely used within this time period. We saw phishing emails unrelated to COVID-19 had a slightly lower click rate (with a median of 3.1 percent). The phishing emails that were linked to COVID-19 had a somewhat higher median at 4.1 percent and showed more organizations having far higher click rates – over 50 percent in some cases. A phishing simulation performed on approximately 16,000 people in late March (the early weeks of shelter-in-place for many states in the USA) found that almost three times as many people not only clicked on the phishing link, but also provided their credentials to the simulated login page than in pre-COVID-19 tests late last year. This heightened emotional response is completely understandable when COVID-19-related terms are involved and are being exploited by cybercriminals.

Comprehensive security strategies can help steer in these unchartered waters

Businesses around the globe have continued to focus on serving their employees and customers as a priority throughout the pandemic. Armed with insights into the evolving tactics used by cybercriminals during this period and comprehensive security strategies – such as managed security services, identity solutions and most importantly on-going employee education – we can set a more productive course to help create a more secure business environment and maintain business momentum.

Also Read: New digital workplace – overcoming the limits of time & place


Be a part of Elets Collaborative Initiatives. Join Us for Upcoming Events and explore business opportunities. Like us on Facebook , connect with us on LinkedIn and follow us on Twitter, Instagram.

Related Article