Most importantly, the hackers claim to have stolen 6 terabytes of data, including social security numbers. MGM is said to have lost $80 million in revenue from the shutdown. 

Your takeaways

This ransomware attack occurred because of a social engineering technique used on the IT Help Desk. Does your security awareness plan for 2024 currently include role-based security training for your IT Desk? What does your IT team need help with to feel supported?

Considering the stark revenue loss from the shutdowns, also consider taking a look at what your business would do if your network had to be blacked-out. Could you still function? How?

The biggest public sector headline

Ontario hospitals & Toronto Public Library ransomware attacks

At the end of October 2023, Ontario hospitals along with the Toronto Public Library lost access to thousands of patient information in ransomware attacks. These breaches served as a wake-up call, showing that even public entities are not exempt from cyber threats.

For the hospitals, the attack led to network outages in locations in Sarnia, Windsor, and more. After further investigation, the hospitals released updates that confirmed that millions of customer data were affected. The most alarming part of this breach was that the hospitals had patient SIN numbers stored, making it easy for cyber criminals to impersonate the patients and potentially access their banking or government accounts. 

The Toronto Public Library suffered from a ransomware attack around the same time as the Ontario hospitals. They are now reporting that some of their services won’t be back online until 2024. This story serves as a stark reminder that businesses have to be prepared for their business to function offline in emergency situations. 

Your takeaways

No industry is immune to cyber criminals. They don’t care if you are giving out books for free or saving lives, they will still sell your data and threaten you for ransom. So, if you are a business that has been slacking due to the belief that it could “never be you”, let 2024 be the year that you let go of that and begin investing in your security awareness program. 

The biggest real-world impact

Suncor cyber attacks

The Suncor Energy cyber attack led to the most impact in the “real world” for Canadians in 2023. While details about the attack and possible ransom payments remain undisclosed, the consequences were impossible to hide. 1,500 Petro Canada retail locations shut down across the country during their network black-out, leaving customers frustrated with cash-only payments and the loss of membership perks.

An interesting insight into this incident is that the CEO was new to his position, having just been hired two months prior. He stated that with this incident he learned more about analytics and IT than he ever had before.  

Your takeaways

Assess the functionality of your business during an offline scenario. How would your customers reach you? Could they still use your service? What would the cost of an organizational disruption be? Present this data to your executives to emphasize the importance of investing in cyber security programs and increased budgets for 2024.

Additionally, you never know when breaches are going to hit. These attacks occurred just when the CEO was new to his position, with little knowledge of the IT of the business. Take proactive steps to ensure that each employee at every level has the understanding they need to protect their business and react to any emergency situations. Have them involved in the breach plan so they understand what would happen if something like this were to occur.

Create role-based training using Click Armor’s customized groups. Schedule a demo with us to get set up for 2024. 

The Canadian top search

Indigo cyber attack

In 2023, the Indigo cyber attack made waves as the top Canadian cyber attack search query on Google. This beloved brand, known for its books and home decorations, experienced a breach early in the year, citing “technical issues” on February 8th.

For two weeks book-lovers were unable to purchase books online from Indigo. It wasn’t until February 22nd that a limited selection of novels was available again and two more weeks until the full store was back online.

Due to the first week’s black-out that left card machines unusable and the month-long disruptions on their online store, Indigo faced significant revenue losses. Although the store never confirmed how much was directly from the cyber incident, the yearly numbers aren’t looking great.

Your takeaways

The Indigo cyber attack highlights the vulnerability of businesses during times of organizational restructuring. It is unclear whether cyber criminals deliberately target companies during these periods, but they do take advantage of any crisis, including leadership changes.

If your business is undergoing restructuring in 2024, be mindful of the increased risk of cyber attacks. Stay vigilant and ensure your new hires are adequately trained to mitigate potential threats.

The ongoing event

23andme

Cyber criminals had to end 2023 off with a bang, continuing to still make headlines by hacking the data of 6.9 million users from ancestry DNA business 23andme. According to TechCrunch, the data included the user’s name, birth year, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location.

The breach was facilitated by customers reusing old passwords, allowing cyber attackers to exploit passwords obtained from other data breaches. As customer accounts are linked to their family members’ accounts, this attack had a ripple effect.

Your takeaway

Don’t report until you know. 23andme initially reported that the attackers were only able to access 14,000 users’ data. They later continued to spiral their reporting until the number eventually landed on 6.9 million users, a huge jump from where they initially began.

Also consider the password rules you have for your employees and customers. Ensure that they are following the password best practices and regularly update their passwords. 

 The cyber crime icon

The passing of Kevin Mitnick

Lastly, we’d like to honour the late Kevin Mitnick who sadly passed away at age 59 this year. Kevin was an iconic figure in the cyber security industry making memorable marks on the world with his hacking, insightful books, and transformative cyber security training. 

After being named “The Most Wanted Hacker” in the 1990s, Mitnick turned towards education, writing 3 books giving insights into the tactics of hackers and creating his own training module with KnowBe4 on security awareness. 

With that, the 2023 season of cyber security comes to an end! Let these top news stories serve as lessons for your business going into the new year. Remember to advocate for stronger, role-based security awareness training and more investment into your cyber security program. Learning now will stop you from being in the headlines yourself next year.

Scott Wright is CEO of Click Armor, the gamified simulation platform that helps businesses avoid breaches by engaging employees to improve their proficiency in making decisions for cyber security risk and corporate compliance. He has over 20 years of cyber security coaching experience and was creator of the Honey Stick Project for Smartphones as a demonstration in measuring human vulnerabilities.