The Most Exposed and Targeted Sectors at Risk of Cyber Crime

Data Source: Check Point Average Weekly Cyberattacks (2021) per Organization by Industry

With the cost to manage vulnerabilities in digital security expected to grow from $6.7 billion in 2020 to $15.86 billion by 2030, it makes sense to know the cyber risks your industry faces to proactively prepare.

Human error is the main risk factor for business cyberattacks. When your employees use smartphones for work, they are introducing vulnerabilities. Third-party apps, internet browsing, Bluetooth, GPS, USB connectivity – all of these are vectors for malicious actors to access your sensitive and valuable data. Imagine how much more secure these sectors would be if they used encrypted, hardened phones. Never mind the cost to your bottom line or reputation.

According to Check Point Research, 2021 saw a 40% increase worldwide in cyberattacks with about one in 60 organizations impacted weekly by ransomware.

“The researchers define a cyberattack attempt as a single isolated cyber occurrence that could be at any point in the attack chain — scanning/exploiting vulnerabilities, sending phishing emails, malicious website access, malicious file downloads (from Web/email), second-stage downloads, and command-and-control communications.”

Here’s a look at the five industries most targeted by cyberattacks in 2021, inspired by research posted in Forbes by a global thought leader in cybersecurity and emerging technology, Chuck Brooks.

Education/Research

Considering the shift to distance learning during the pandemic, it is not surprising education and research is the top sector being targeted by malicious actors. The Data Group Manager at Check Point, noted, “Students, parents and schools are tempting targets for hackers, mainly because of data – there’s lots of it. From gradebooks to online assignments, hackers have far more access points to sensitive information and data. Data is leverage for hackers and can be used to orchestrate ransomware attacks.”

The top regions for cyberattacks on education/research were the Pacific Rim, with an average of 4,176 a week in Australia and New Zealand, just slightly ahead the rest of Asia. Europe had 1,861 attacks weekly.

A study of ransomware attacks in 2021 revealed education and retail were equally targeted with a 44% increase, yet as a sector education had three times as many cyberattacks. Schools, tied with places of worship, received the most brand-impersonation credential phishing attacks.

Government/Military

This was the second highest sector to be attacked in 2021. Government agencies are high valued targets for the information they hold with a vast amount of confidential data, which hackers exploit – often through state-sponsored attacks.

At the end of 2021, the Log4j vulnerability left countries around the world scrambling to fix the single biggest threat in the last decade and likely the most critical code loophole ever. The Belgian military, as an example, was hit hard and spent five days countering the cyberattack.

The SolarWinds Supply Chain Trojan attack was a global threat, believed to have been a Russian sponsored attack, which affected the US government as well as major corporations. Newsweek reported, “State Department, Department of Homeland Security and some parts of the Pentagon appeared to have been compromised.”

An Iranian Facebook hacking campaign target US Military was revealed in 2021 in which social engineering was used to send infected malware files and to use phishing schemes to get credentials.

Communications

In third place, this sector experienced many devastating cyberattacks. The industry vertical for Technology, Media and Telecommunications made headlines around the world for notable takedowns. The Australian broadcaster Channel Nine was hit by a cyberattack, which left the network unable to air several shows or its Sunday news on March 28, 2021. Coincidentally, the Australian government faced an attack at the same time.

Mobile phone companies were also hard hit. A year ago on August 17th, the T-Mobile cyberattack compromised data of millions of their customers, former customers, and prospective customers. T‑Mobile said, “Fortunately, the breach did not expose any customer financial information, credit card information, debit or other payment information but, like so many breaches before, some SSN, name, address, date of birth and driver’s license/ID information was compromised.”

Internet Service Providers/Management Service Providers

Irish ISPs were the target of a series of “denial of service” strikes in May 2021. There was no indication the DDoS cyberattacks were related to the concurrent Health Service Executive ransomware attack, which caused the country’s IT systems to be shut down nationwide.

The Internet of Things has proven to be a major cybersecurity challenge for ISPs. An estimated 25 billion IoT devices were connected online in 2021. Cybercriminals increased their IoT attacks with both ISPs and Telecoms seeing the impact through hacking and data breaches. This included DDoS attacks, Network congestion, RFID interference, Routing attacks, and Sybil attacks on computer network security.

According to the Sophos State of Ransomware 2021 white paper, IT, technology and telecoms were the industry vertical hardest hit by Ransomware.

Management Service Providers are outsourced IT services. Typically, MSPs handle IT infrastructure, technical support, user access within corporate client systems, and hardware outsourcing.

MSPs also act as third-party server storage, provide Software-as-a-Service, or niche technical expertise. Microsoft Exchange is a cloud-based email service. A mass cyberattack affected millions of Microsoft clients around the globe, wherein threat actors actively exploited four zero-day vulnerabilities in Microsoft’s Exchange Server. It is believed that nine government agencies, as well as over 60,000 private companies in the US alone, were affected by the attack.

Healthcare

The Abnormal Security Email Threat Report noted there is a rise in business email compromise attacks. BECs occur when a scammer accesses the email of the targeted business contact and impersonates them using their identity to target other victims.

When cybersecurity expert, Brian Krebs, reported on Ransomware attacks in the Healthcare sector, he asked a source how many healthcare organizations get hit with ransomware on average in one week? His source confided “It’s more like one a day.”

The Bigger Picture

Overall, the global distribution of cyberattacks was highest in Africa, with an average of 1,615 per organization each week, which is an increase of 15% over 2020. Asia and the Pacific was second with a 20% increase amounting to an average of 1,300 weekly attacks per organization. Coming in third, with an average of 1,115 attacks weekly, at almost a 40% increase, is Latin America.

Business Email Compromise attacks can be sent to anyone, but executives or finance department personnel are prime targets. According to a report on email and phone fraud scams in 2021, despite having employee preventative training, IT departments and cybersecurity support, the companies with the highest probability of being targeted by an attack are those with the most employees. In fact, enterprise organizations have a 95% chance of receiving a BEC attack every week due to the high volume of email received.

“Small businesses under 500 employees were fortunate to experience only an average 12% probability of attack throughout the half, but large organizations comprised of more than 50,000 employees received an attack nearly three weeks out of each month.”

As a Cybersecurity expert, Brooks shared risk management strategies in a Homeland Security blog,  surmising, “The bottom line is that almost every type of business, large and small, touches aspects of cybersecurity whether it involves law, finance, transportation, retail, communications, entertainment, healthcare, or energy. Cyber threats are ubiquitous, and they can be an existential event for companies and the C-Suite urgently needs to have a plan.”

As world renowned business and technology futurist Bernard Marr stated in his report on the biggest cyber security risks in 2022, “Aside from the potential for breach of privacy, loss of money, and disruption to infrastructure from cyber-attacks, there’s another genuine and pressing problem that’s often overlooked: A loss in the trust in tech and data.”

Myntex has an encrypted mobile solution, ChatMail™, which can securely protect your privacy and reduce your at risk attack vectors for email, messaging, calling, notes and pictures. Enterprise businesses can request a live data extraction proving the soundness of our technology.