Another year down and another record year for cyber security challenges. With an average cost of breaches reaching $4.5m according to research in IBM’s Cost of Data Breaches Report 2022, with the medical industry posting losses of up to $10m. Digging through the data we found that one of the hardest hit industries was actually the local school districts which experienced 216 breaches from January to November of this year.

Schools seem to be attractive targets because of the size and scope of the personal data available with very little cybersecurity budgets or expertise to protect the data.

But even big-budget businesses have been rocked this year as a result of cyber attacks. Here are some of the top cyber events we found for 2022:

Crypto.Com
The year started off with a crypto bang. Not even cryptocurrency is safe from cyberattacks, with hackers stealing up to $18 million worth of Bitcoin and $15 million of Ethereum as well as other various cryptocurrencies from Crypto.com. The breach occurred on January 17th and affected nearly 500 crypto account wallets. While all of the stolen money was returned to the individual person affected, Crypto.com proved that all businesses regardless of their size and security posture are at risk of a significant breach.

Lapsus$ Groups Goes On A Hacking Spree
From Nvidia to Samsung and more, the Lapsus$ group went on a hacking spree with the goal of creating a reputation for the group. By using typical phishing strategies to steal highly sensitive data from organizations and then extort them to keep the data quiet. The plans backfired since the Lapsus$ group did not employ any encryption in their attacks, making it easy for the victims to track down the source. Nvidia is rumored to have “hacked back,” and Microsoft, aware of the group, was able to stop the attempt quickly leaving only one account compromised.

CashApp Gets Hit
A seriously ticked-off former employee of Cash App went on a spree in April 2022 when they breached the corporate server. The hacker stole customer names, stock trading info, portfolio values, account numbers, and other sensitive financial information affecting more than 8 Million customers. The only good (?) news is that no account credentials were stolen…just a limited amount of personally identifiable information.

Marriott Is Targeted…Again
Fool me once…shame on you. Fool me twice…shame on me? In 2014 Marriott hotels were breached and 340 million guest records were exposed. As if this wasn’t embarrassing enough, the breach went undetected for 4 years. 2 years later, in 2020 Marriot was hit again, affecting 5.2 million guest records.

Seemingly unruffled by the two previous attacks, Marriott was hit again in June of 2022, this time listing more than 20GB of sensitive data such as guests’ credit card information. How were they successful again? Social engineering an employee at a property in Maryland into giving them access to the employee’s computer.

Employee education is key…

Uber is targeted by a teenager
Yes, you read that right. Uber’s internal systems were compromised by a curious teenager in September. Using a tactic known as “MFA Fatigue” the teenager obtained an employee’s credentials and then proceeded to bombard the employee’s cell phone with authentication requests. After refusing the requests, the attacker contacted the employee through WhatsApp claiming to be with Uber’s IT and that the only way to stop the incessant requests was to accept the request. From there he was able to access corporate information and privileged access management platforms.

Healthcare is still an attractive target
A Massachusetts-based medical services provider experienced a significant breach in March – exposing more than two million patient details and affecting up to 53 separate facilities. Ransomware gangs are attracted to these service providers because of the access to a wide range of company data and provide more potential ransom sources.