In 2020, COVID-19 affected the world in ways no one could have predicted. Everyone tried to survive in virtual worlds. Although we are exposed to unpredictable situations in 2020, we need to be prepared for the threats of the cyberspace we live in.

As we end 2020, we wanted to look back at the biggest cyber attacks and breaches that occurred in 2020 before predicting the cyber threats that await the world in the next year.

The biggest Cyber-attacks and Data Breaches in 2020

As a result of the pandemic period, many organizations made a massive shift to supporting remote work in a very short time. This had enormous implications for how people live, and in how organizations think about cybersecurity and business continuity.

Before jumping into the possible threats and attacks for 2021, lets briefly look at the biggest and most memorable cyber attacks and breaches that took place in 2020.

Microsoft Data Breach

In January 2020, 250 million Microsoft customer records were exposed online without password protection. These records were customer service and support logs detailing conversations between Microsoft support representatives and customers around the world. Comparitech security research team uncovered five Elasticsearch servers, each containing a seemingly identical set of 250 million records.

The Marriott Data Breach

At the beginning of 2020, Marriott which is one of the largest hotel brands announced that the personal information of nearly 5.2 million hotel guests had been hacked. Personally identifiable information accessed included names, addresses, phone numbers, dates of birth, and airline loyalty information.

World Health Organization

The World Health Organization (WHO), which played a vital role during the coronavirus epidemic, was exposed to a cyber attack in March 2020. WHO said the attackers targeted their employees using a phishing attack, and there was a huge data leak of 25,000 email addresses and passwords.

Easyjet Data Breach

EasyJet announced that they were subjected to a highly sophisticated cyberattack and that the attack affected nearly nine million customers. EasyJet warned nine million customers to watch out for phishing attacks whose email addresses were stolen. The credit card details of 2,208 customers were breached. Stolen credit card data included the three-digit security code on the back of the card itself.

Twitter Bitcoin Scam

Some of the most well-known and high-profile Twitter users, such as Barack Obama, Elon Musk, Joseph R. Biden Jr., Bill Gates, were compromised. Accounts demanded Bitcoin from their followers and promised to double in return. After these tweets, the attackers obtained more than $ 100,000 worth of Bitcoin.

Zoom Security Flaws

Zoom has become one of the most recognized and widely used videos and audio conferencing platforms, with the rapid increase in home workers due to COVID-19. In the first week of April 2020, Zoom has experienced several security incidents, most notably about 500,000 user accounts being put up for sale on a dark web forum.

Telegram Hijack

In September 2020, hackers accessed Telegram messenger and email data of some big names in the cryptocurrency business using Signaling System 7 (SS7) used for connecting mobile networks across the world. The attackers intercepted text messages and calls of a legitimate recipient by updating the location of the devices as if it registered to a different network.

Zero-days in VPN Products

In 2020, many vulnerabilities with critical, high, and medium severity were discovered in many popular VPN products such as Fortigate, Palo Alto, Cisco, and Pulse Secure. A remote attacker could exploit these vulnerabilities to take control of an affected system. VPN has become one of the most important cyber threats in 2020, where organizations establish a secure connection with employees while working remotely.

Israel Data Breach

A software bug exposed the personal data of 6.5 million Israeli voters — including full names, addresses, and ID card numbers — three weeks before the country\’s national elections, causing concerns about identity theft and election manipulation. The vulnerability was found in a mobile application used by Prime Minister Benjamin Netanyahu and his party to communicate with voters who provided news and information about the elections.

Pakistan Data Breach

44 million Pakistani mobile users information was leaked online. Based on analysis of the leaked files, this information included the full names of customers, home addresses, national identification numbers, mobile phone and landline numbers, and subscription dates. The attackers tried to sell the stolen information for $ 2.1 million in bitcoins.

SolarWinds Supply Chain Attack (SUNBURST and SUPERNOVA)

The supply chain attack, which was explained by FireEye discovery of the backdoor in Solarwinds software, appeared to affect a larger area. CEO of FireEye Kevin Mandia said that hackers who infiltrated government and business networks via a stealthy software update appear to have \”genuinely impacted\” about 50 organizations. Although the full list of victims is unknown, Microsoft and VMware are among the victims. The malicious code is thought to have been sent to about 18,000 customers. The products of Solarwinds are used by more than 300,000 customers worldwide, including government agencies, US Military, NASA, and NSA.

Cybersecurity Predictions for 2021

2020 has been a strange and troubling year for everyone. Are you ready to be more confident about your company s cybersecurity entering 2021? To help you be prepared and secure for the coming year, here are cybersecurity predictions that we think everyone should know about.

Healthcare Data Breaches

Considering the importance of patient data in the pandemic period, data leaks in the health industry last year will likely affect our next year. Some studies have revealed that the vast majority of healthcare organizations are unprepared to respond to cyberattacks. It is also predicted that attacks against COVID-19 vaccine developers will continue. As healthcare organizations such as WHO experienced in 2020, attackers can send coronavirus-related emails with malicious attachments, design phishing campaigns, and launch targeted attacks to grab the attention of interested parties.

Endpoint Security and Home Networks

With the conditions of working from home, making endpoint security and home network security has become an important point that deserves attention. Devices and homes of remote workers have become a route to trusted corporate networks. Businesses need to focus on endpoint security systems and zero trust model. Therefore, in 2021, we expect remote workers to become more familiar with endpoint cybersecurity systems.

Credentials Re-Use

The reason behind the huge data leaks in some social media platforms such as TikTok, Instagram, and Youtube in 2020 was the reuse of the same credentials in more than one application. As long as users continue to use the same passwords in multiple services, this threat will continue to be important both in 2021 and in the years ahead.

Cloud Breaches

With the transition to remote work and accelerated digital transformation in 2020, the need for a digital, easily accessible cloud-based platform has no doubt increased. This will drive demand for modern cloud-based solutions and companies are rapidly moving to simplify and shift things to the cloud. More techniques will emerge to bypass MFA that abuse cloud permissions and rely on mechanisms and therefore cloud infrastructure requires special attention from organizations.

VPNs and RDPs Security

Attackers concentrate on VPNs and RDPs as the remote workforce grows. The VPN vulnerabilities experienced by global VPN companies such as Fortigate and Cisco in 2020 will be greatly increased in 2021. The company will continue to use Virtual Private Networks (VPN) and Remote Desktop Protocol (RDP) solutions to provide secure connections for employees working from home.

Ransomware Attacks

As we enter 2021, ransomware will continue to be a big part of attackers. Attacks on healthcare and medical infrastructure are likely to continue. Ransomware will get worse with data-stealing before encryption, malware packaging with other threats, and very specific targeting of organizations. These attacks have become more complex and automated, and new techniques are likely to be seen in our next year.

Multi-Factor Authentication (MFA) Exploitation

Authentication is one of the highlights of strong security. As billions of usernames and passwords continue to appear on the dark web, as a result of frequent massive data leaks, we anticipate that any service without MFA enabled will be compromised by 2021. The ubiquitous implementation of MFA will help minimize the occurrence of data theft and phishing attacks. Businesses should always be one step ahead of malicious actors.

5G Vulnerabilities

Next-generation internet and mobile connectivity 5G will become more widespread in the next year. 5G, which will have a revolutionary effect on telecommunications, will offer many opportunities to attackers because it is very new and complex. Lots of 5G vulnerabilities will become headline news as the technology grows. 5G to be used in areas such as defence facilities, smart electricity grids, and smart cities require a higher level of security.

IoT Devices Security

As 5G networks expand across the globe, the number of connected IoT devices will increase drastically, significantly increasing the vulnerability of these devices to cyberattacks. With this, problems with wireless network security will also increase. All of these are cybersecurity threats from IoT devices placed in homes, public places, or workplaces.

References:

https://www.forbes.com/sites/daveywinder/2020/01/22/microsoft-security-shocker-as-250-million-customer-records-exposed-online/?sh=3e97f0304d1b

https://excelien.com/biggest-cyber-attacks-of-2020/

https://www.govtech.com/blogs/lohrmann-on-cybersecurity/the-top-21-security-predictions-for-2021.html

https://www.znetlive.com/blog/top-10-cybersecurity-incidents-in-2020/

https://www.bbc.com/news/technology-52722626

https://securityboulevard.com/2020/08/5-biggest-data-breaches-of-2020-so-far/

https://www.isaca.org/resources/news-and-trends/industry-news/2020/top-cyberattacks-of-2020-and-how-to-build-cyberresiliency

https://www.nytimes.com/2020/02/10/world/middleeast/israeli-voters-leak.html?action=click&module=News&pgtype=Homepage

https://www.zdnet.com/article/details-of-44m-pakistani-mobile-users-leaked-online-part-of-bigger-115m-cache/

https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities

https://www.zdnet.com/article/cisco-releases-fixes-for-critical-vpn-router-vulnerabilities/

---

Cybersecurity Predictions for 2021 was originally published in Hacker Academy on Medium, where people are continuing the conversation by highlighting and responding to this story.