Why Are Corporations Still Experiencing Data Breaches?

In the digital age, corporations need to take extra precautions to secure their information, including sensitive client information. While cybersecurity measures have come a long way, there are still many vulnerabilities being exploited by bad actors.

Below, we discuss some of the steps these bad actors take to breach a corporation’s internal services and what they do once they gain access.

If you have received a notification of a data breach from any company, you should strongly consider speaking to our data breach lawyers in Sacramento as soon as possible to learn more about protecting your information and what legal options may be available to you to recover compensation.

How Are Data Breaches Still Occurring?

As corporations have begun putting more emphasis on cybersecurity, bad actors hoping to access their information have also started ramping up their own efforts to overcome these security measures.

Microsoft recently released updated information on a large-scale social engineering and extortion campaign that provides some insight into how some of these bad actors gain access to an internal system and use other methods to extract the information they want for financial gain.

Initial Access

There are a variety of methods used by these entities to obtain passwords and other credentials necessary to gain access to a company’s internal systems. Some of these methods include:

• Deploying malicious Redline password stealers
• Purchasing credentials and session tokens from criminal dark web forums
• Paying employees within the targeted organization to access credentials and multi-factor authentications

Microsoft also discovered that these entities often first gain access to employees’ personal devices, which are often used for password recovery or multi-step authentication, to gather information to access the company’s system. In a process called “SIM-swapping” attackers gain access to a user’s phone number before signing into the corporate network. This can be used to handle phone-based authentication prompts to gain access to the target company.

Some entities are brash in their efforts and even post advertisements on social media or web forums looking for insiders who are willing to sell company information.

Reconnaissance

Once access is obtained, other tactics are used to extend the scope of that access, including:

• Taking advantage of unpatched vulnerabilities on internal servers
• Searching codes and platforms for additional credentials and sensitive information

The reconnaissance process allows the bad actor to spy on the internal server to see which accounts have higher privileges. Once those high-ranking accounts are identified, the bad actor goes after that account using some of the same processes as before, but also uses internal communication channels, like Teams and Slack, to escalate access.

The process keeps going until the highest level of access is reached.

Extortion

The purpose of bad actors accessing internal corporate servers is monetary gain. Bad actors’ plan once they have gained all access is to download all the necessary sensitive information and lock out the legitimate account holders for the purpose of extortion.

The bad actors frequently threaten public release of the sensitive information if a ransom is not paid by the corporation, but the attack does not stop there. Microsoft has also observed some bad actors using the initial access and control of internal systems to also gain access to crisis communications to see how the corporation is responding to the attack.

Impact

Entities in various industries have been hacked by these bad actors, including:

The more companies are impacted by these security breaches, the more likely your information is vulnerable. If you have received a notification of a data breach, call the Arnold Law Firm today.

What Are the Recommendations to Prevent a Breach?

There are some steps corporations should be taking to help prevent data breaches, including the following:

The Federal Trade Commission has also released a guide to help businesses that are affected by data breaches.

How Businesses May Be Liable for Data Breaches

Despite a corporation’s role as the victim in a data breach, if client information is exposed in the breach the company could be held liable for damages.

Liability may fall to the company if there was a lack of security either by the company’s own cybersecurity personnel or that of a third-party vendor in charge of security.

Was Your Information Exposed in a Data Breach? Call Us Today

Every data breach case is different, so it would be in your best interest to speak to an attorney if your information was exposed in a data breach.

We offer a free consultation to discuss your claim and see what legal options may be available to you.

Call 916-777-7777 to learn more.