Companies paying hush money to data thieves
26 February 2016 | 0
There is a disturbing new angle to cyberattacks that has become more common over the last year, and it is proving costly for organisations: extortion.
Over the last year, companies have at times paid more than $1 million (€907,190) in hush money to cyberattackers who have stolen their sensitive data and threatened to release it online, said Charles Carmakal, a vice president with Mandiant, the computer forensics unit of FireEye, in an interview on Wednesday.
“This is where a human adversary has deliberately targeted an organisation, has stolen data, has reviewed that data and understands the value of it,” Carmakal said. “We have seen seven-figure pay-outs by organisations that are afraid for that data to be published.”
Mandiant outlined such attacks in a new report, saying in some cases, executives have been also taunted by hackers. Extortion attacks are more sophisticated than so-called ransomware such as Cryptolocker, the malware that encrypts a computer’s files and where payment is in bitcoin.
While ransomware attacks can be devastating in their bluntness, the payment demanded usually is a few hundred dollars, although some attacks have succeeded in extracting much more.
The extortion attacks, however, are far more meticulous and could be potentially more damaging, especially to a large company. Carmakal said some of the data, if publicly revealed, could potentially put a company out of business.
So “the reality is lots of people are paying,” he said.
For Mandiant, which has investigated large data breaches at Target, Home Depot and Anthem, it can be tough to advise an organisation about what course of action to take, Carmakal said.
The attackers often do not give much time to allow for a full forensics review to figure out if the hackers are bluffing. And there are fakers looking for an easy pay-out.
“What we need is proof that someone actually has access to data,” Carmakal said. “We get them to send a sample, or we do as quick an investigation as we can.”
If forensic artefacts reveal that someone has been sneaking around, next comes a very hard decision: even if a company pays, there’s no guarantee that the attackers won’t release the data anyway.
“There’s absolutely a risk in not paying, and there’s a risk in paying,” Carmakal said. “Everybody’s goal is that they pay the ransom, and the attackers go away and they delete data, but you will never get the confirmation that you want that the attackers have deleted the data.”
IDG News Service