Over the past several months, it’s become hard to ignore the fact that the digital lives we’ve all built for ourselves appear to be completely and utterly vulnerable to cybercriminals and spies.
Whether hackers were coming after our nation’s beer, hamburgers, or energy supply, cybercriminals have made it known that they really don’t mind upending our way of life if it means making some cold hard cash. Meanwhile, a flurry of cyber-espionage has targeted some of America’s biggest institutions, showing that foreign spies have the resources to get into some of the networks that matter most. It’s enough to make you unplug your laptop and throw it out the window.
Before you do that, however, here’s a fond look back at the highlights from just this year — a whole lot of hacking in a short period of time. Read on and enjoy the paranoia.
SolarWinds
A big protean mess that seems to have no real beginning or end, the “SolarWinds” hack will likely continue to influence the conversation around U.S. cybersecurity for years to come. The hack, which U.S. authorities believe involved Russian (and maybe Chinese) threat actors worming their way into the networks of major federal agencies and American companies via compromised software, helped said hackers gather untold amounts of intelligence on the U.S. government and private sector. While the incident was first publicised in December, subsequent disclosures about the extent of the hack have continued over the past six months, leading to multiple congressional hearings, audits, and investigations.
Despite being commonly referred to as “SolarWinds,” the hack actually involved a compromise of at least three different software firms, including SolarWinds, Microsoft, and VMWare, according to the Cybersecurity and Infrastructure Security Agency (CISA). A total of 12 federal agencies are confirmed to have been penetrated by the hackers — including the Department of Defence, the Department of Homeland Security, the Federal Aviation Administration, the judiciary, and NASA, among others. The hackers also allegedly wormed their way into the networks of major Fortune 500 companies.
Microsoft Exchange
As dramatic and massive a fuckup as SolarWinds was, what came next was possibly even more widespread: the discovery in March of a smattering of security flaws in Microsoft Exchange — a widely used email product — the likes of which set off a global epidemic of cyberattacks. At the time, Bloomberg reported that the vulnerabilities in Exchange had possibly led to “at least 60,000 known victims globally,” around 30,000 of which were inside the U.S. Many of the attacks were blamed on a group dubbed “HAFNIUM,” potentially located in China. However, the vulnerabilities set in motion what was basically a rat-king of hacker activity — with close to a dozen different cybercrime groups reportedly pillaging vulnerable servers and implanting backdoors.
Colonial Pipeline
The Colonial Pipeline attack is likely the most important U.S. cyberattacks of the year so far — both for its ability to show the devastating potential of cybercrime and for the robust federal response it inspired. It also showed our country is still completely and utterly addicted to oil and will be for the foreseeable future.
In May, hackers affiliated with the ransomware gang DarkSide managed to get inside the network of Colonial Pipeline, one of America’s largest oil and gas companies. By temporarily halting the pipeline’s operations, the attack not only spurred a short-lived energy crisis throughout the Southeast — the likes of which devolved into a panicked melee at gas stations in multiple states — it also fundamentally shifted how the federal government approaches cyberattacks of this nature. Following the attack, the FBI managed to trace and seize a significant portion of the cryptocurrency ransom payment that Colonial made to the hackers — a somewhat unprecedented development. At the same time, the event helped to catalyze an accelerating government initiative to crack down on cybercriminals, including a new ransomware task force put together by the Justice Department and other defensive policies put out by the Biden administration.
CNA
CNA, one of America’s largest insurance companies, has made a big push to sell cyber insurance — a product that, ironically, is designed to protect businesses from exactly the kind of scenario that CNA itself recently wound up in. In March, a ransomware group calling itself “Phoenix” attacked the company, successfully grabbing large amounts of its data. CNA should definitely get, like, an award or something for its subsequent philanthropic contribution to the digital underworld: the company allegedly paid their data-captors a whopping $US40 ($51) million — a figure that certainly sets the record for publicly known payments in these scenarios.
At the time, security professionals commented on how dangerous it was that a hacker group may have gained control of cyber insurance policy holder information, as it could allow for more targeted attacks calibrated exactly to victims’ financial information. On the other hand, “Phoenix” operators may have been so rich after their big CNA payout that they just decided to call it a day, forego all future attacks, and retire to some undisclosed hacker paradise.
JBS
On May 30, JBS, a Brazilian meat processor that serves as America’s largest source for beef and pork, discovered that hackers affiliated with the ransomware gang REvil successfully compromised its networks. JBS then reportedly paid REvil $US11 ($14) million for the decryption of their data — providing yet another example of the kinds of havoc a well-placed cyberattack can wreak on pivotal consumer supply chains. Between Colonial Pipeline and this, you’d start to wonder whether these hacker gangs were secretly a bunch of vegan, anarcho-environmental activists looking to teach Americans the error of their gas-guzzling, cow-slaughtering ways. Alas, no. They’re likely just ruthless opportunists, hellbent on extorting big money by hitting our country where it hurts the most: our love of all things environmentally unfriendly.
Metropolitan Police Department
While maybe not one of the biggest attacks of the year, the hacking of Washington, D.C.’s Metropolitan Police Department was certainly one of the most dramatic incidents in recent memory — and showed a new willingness by ransomware gangs to target law enforcement agencies with increasingly dangerous tactics. The ransomware gang Babuk attacked MPD in April, making off with 250 gigabytes of sensitive internal data — including disciplinary files on past and current police officers, intelligence on local protest activity, and, most alarmingly, information on informants embedded in criminal networks scattered throughout the city. The hackers then threatened to leak the data if their demands of a $US4 ($5) million ransom were not met. Cops were so distressed they offered to pay $US100,000 ($128,260) for the files, though the hackers declined — and subsequently dumped everything online.
Accellion
The biggest “sleeper” attack of the year so far, the hacking of a little-known cloud company called Accellion didn’t get as much press as other hacks but had big implications worldwide. In December, the ransomware gang ClOP used security flaws in one of Accellion’s most widely used products to hack the files of dozens of prominent entities throughout the world. The victims included Shell Oil, about a half dozen American universities, a Canadian aerospace manufacturer, banks and transportation agencies, a telecom conglomerate in Singapore, and one of America’s largest supermarket chains, Kroger, among others.
Of course, as of this writing, 2021 is only halfway over. At the rate we’re going so far this year, these major hacks are unlikely to be the last.