Security Market Segment LS
Friday, 06 April 2018 02:31

Records breaches cost US$8bn, ransomware the main culprit Featured

Records breaches cost US$8bn, ransomware the main culprit Image courtesy of Stuart Miles at

The number of records breached dropped nearly 25% globally in 2017, but ransomware breaches still cost organisations US$8 billion, with human error responsible for two-thirds of compromised records.

According to the 2018 IBM X-Force Threat Intelligence Index, while the decline in breaches is a great result for everyone — except cyber criminals — there is still a long way to go with 2.9 billion records (down from 4 billion disclosed in 2016) reported breached and ransomware incidents alone costing organisations more than US$8 billion in 2017.

The IBM report found number of breaches dropped as cyber criminals shifted their focus to ransomware and destructive attacks that lock or destroy data unless the victim pays a ransom.

IBM says that while the number of records breached was still significant, ransomware reigned in 2017 as attacks such as WannaCry, NotPetya, and Bad Rabbit caused chaos across industries without contributing to the total number of compromised records reported.

Other key findings include:

•    A historic 424% jump in breaches related to misconfigured cloud infrastructure, largely due to human error;

•    For the second year in a row, the Financial Services industry suffered the most cyberattacks against it, accounting for 27% of attacks across all industries.

 And in Australia, the trends are similar to the global security environment.

“The trends in Australia are in line with what we are seeing around the world. Globally we saw a 424% increase in records breached through misconfigurations in cloud servers,” says Pelin Nancarrow, IRIS Asia Pacific, IBM Security.

But Nancarrow says there are steps organisations in Australia can take to mitigate cloud configuration risks, including:

•    Conduct a proper risk assessment on the cloud deployment you or your organisation uses so you can first understand where/if there are risks that need attention.

•    Apply data confidentiality controls such as data encryption. If used effectively, this can minimise the impact in a case of leaked data.

•    For enterprise customers contracting the services of a cloud provider, embed your security policies into the contract to ensure cooperation from your vendor.

•    Use reliable threat intelligence sources to stay apprised of any new threats that may apply to your organisation and help you re-assess risk.

The IBM X-Force Threat Intelligence Index is comprised of insights and observations from data analysed via hundreds of millions of protected endpoints and servers across nearly 100 countries.

"While breached records are a good indication of cybercriminal activity, it doesn’t tell the full story of 2017," said Wendi Whitmore, global lead, IBM X-Force Incident Response and Intelligence Services.

"Last year, there was a clear focus by criminals to lock or delete data, not just steal it, through ransomware attacks. These attacks are not quantified by records breached, but have proven to be just as, if not more, costly to organisations than a traditional data breach. The ability to anticipate these attacks and be prepared will be critical as cybercriminals will continue to evolve their tactics to what proves most lucrative.”

IBM also reports:
 •     Ransomware attacks put pressure on incident response

Ransomware and destructive attacks, such as WannaCry, NotPetya, and Bad Rabbit, not only grabbed headlines in 2017, but also brought major organisations to a halt as cyber criminals took over and locked critical infrastructure in healthcare, transportation, and logistics, among others. Overall, ransomware incidents have cost organisations more than US$8 billion in 2017 as cyber criminals launched debilitating attacks that were focused on locking critical data instead of compromising stored records.

This trend puts increased pressure on organisations to be properly prepared with incident response strategies to limit the impact of an attack. An IBM Security study last year found that a slow response can impact the cost of an attack as incidents that took longer than 30 days to contain cost US$1 million more than those contained within 30 days.
•    Human error remains a weak link

In 2017, cyber criminals continued to take advantage of human error and mistakes in infrastructure configurations to launch attacks. In fact, the report shows that inadvertent activity such as misconfigured cloud infrastructure was responsible for the exposure of nearly 70% of compromised records tracked by IBM X-Force in 2017. The report shows that there is a growing awareness among cyber criminals of the existence of misconfigured cloud servers. For example, 2017 saw an incredible 424% increase in records breached through misconfigurations in cloud servers.

Beyond misconfigured cloud, individuals lured via phishing attacks represented one-third of inadvertent activity that led to a security event in 2017. This includes users clicking on a link or opening an attachment laced with malicious code, usually shared via a spam campaign launched by cyber criminals. The report found that in 2017, cyber criminals relied heavily on the Necurs botnet to distribute millions of spam messages over a span of just a few days in some instances. For example, over a two-day period in August, IBM X-Force research observed four separate Necurs campaigns spamming 22 million emails.
•    Cyber criminals find success targeting financial services customers

In years past, Financial Services has been the most targeted industry by cyber criminals. In 2017, it fell to the third-most attacked (17%) — behind Information & Communications Technology (33%) and Manufacturing (18%) — yet saw the most security incidents (27%) — those requiring further investigation — compared to other industries.

While Financial Services organisations have invested heavily in cyber security technologies to protect organisations, cyber criminals focused on leveraging banking trojans specifically targeting consumers and end users across the industry.

For example, the IBM X-Force Threat Intelligence Index report found that in 2017, the Gozi banking trojan and its variants were the most prevalently used malware against the Financial Services industry. The Gozi malware specifically targets customers as it takes over initial banking login screens with prompts for consumers to enter other personal information that is then shared directly with the attacker.

The use of Gozi, considered to be run by a skilled cyber crime operation, highlights how organised crime is overtaking all other classes of actors in the financial malware-facilitated fraud scene.


Recently iTWire remodelled and relaunched how we approach "Sponsored Content" and this is now referred to as "Promotional News and Content”.

This repositioning of our promotional stories has come about due to customer focus groups and their feedback from PR firms, bloggers and advertising firms.

Your Promotional story will be prominently displayed on the Home Page.

We will also provide you with a second post that will be displayed on every page on the right hand side for at least 6 weeks and also it will appear for 4 weeks in the newsletter every day that goes to 75,000 readers twice daily.



Some of the most important records are paper-based documents that are slow to issue, easy to fake and expensive to verify.

Digital licenses and certificates, identity documents and private citizen immunity passports can help you deliver security and mobility for citizens’ information.

Join our webinar: Thursday 4th June 12 midday East Australian time


Peter Dinham

Peter Dinham - retired and is a "volunteer" writer for iTWire. He is a veteran journalist and corporate communications consultant. He has worked as a journalist in all forms of media – newspapers/magazines, radio, television, press agency and now, online – including with the Canberra Times, The Examiner (Tasmania), the ABC and AAP-Reuters. As a freelance journalist he also had articles published in Australian and overseas magazines. He worked in the corporate communications/public relations sector, in-house with an airline, and as a senior executive in Australia of the world’s largest communications consultancy, Burson-Marsteller. He also ran his own communications consultancy and was a co-founder in Australia of the global photographic agency, the Image Bank (now Getty Images).



Recent Comments