Tag: cyberattack

Victims of cybercrime shelled out a record $1.2 billion to have their data returned last year as ransomware attacks have grown in size and intensity, according to newly released federal data.

The Financial Crimes Enforcement Network, or FinCEN, reported that banks processed a billion-plus dollars last year in what were likely ransomware payments. That’s more than double the amount of money from 2020, the report concluded. The top five highest-paid ransomware incidents all came from attackers who were connected to Russia, FinCEN said.

The report “reminds us that ransomware — including attacks perpetrated by Russian-linked actors — remains a serious threat to our national and economic security,” Himamauli Das, FinCEN’s acting director, said in a statement this week.

Ransomware is a type of computer hack where an attacker accesses someone’s digital device and locks the owner out of their own files. After the lockout, the hacker contacts the owner and demands a payment before restoring access to the files. If there’s no payment, the hacker threatens to keep the owner locked out or delete the files completely.

FinCEN, which started in 1990, is an arm of the U.S. Department of Treasury charged with tracking international money laundering, terrorist financing and other financial crimes. 

FinCEN said hackers initially focused ransomware attacks on individuals, but have graduated to targeting large companies and demanding bigger payouts. Hackers in 2019 created a variation of ransomware attacks called double extortion, where they lock owners out of their files and then threaten to publish the data — which is often private or potentially embarrassing — if a payment isn’t made. 

Nearly double that of 2020

Indeed, 2021 had some of the biggest ransomware attacks on record aimed at large companies and nonprofits. A Russian hacking group attacked the Colonial Pipeline, one of the largest pipelines in the U.S., in May 2021. The company paid $4.3 million to retrieve its data, but federal authorities later recovered at least $2.3 million of the paid ransom. Hackers also attacked Planned Parenthood, Sinclair Broadcasting, Shutterfly and payroll processing company Kronos last year. 

All told, organizations reported 1,489 ransomware attacks to FinCEN in 2021, a 188% increase from 2020, the agency said.

More recently, a ransomware attack last May marked the last straw for Lincoln College, a historically Black college in rural central Illinois that opened in 1865. The school gave hackers a $100,000 ransom, a payout that compounded financial troubles caused by plummeting enrollment in recent years. The 157-year-old institution shuttered in May.

Ransomware attacks have become more common with the rise in remote work and e-learning, with schools becoming particularly vulnerable.

The Biden administration brought together three dozen nations, the European Union and a slew of private-sector companies for a two-day summit this week looking at how best to combat the attacks.

President Biden earlier this year signed a new law that requires owners of factories, banks, nuclear reactors and other critical infrastructure operations to report when their computer systems are hit with ransomware. Reporting is currently optional for ransom victims, making it difficult to calculate the full impact of the crime.

An apparently coordinated denial-of-service attack organized by pro-Russia hackers rendered the websites of some major U.S. airports unreachable early Monday, though officials said flights were not affected.

The attacks — in which participants flood targets with junk data — were orchestrated by a shadowy group that calls itself Killnet. On the eve of the attacks the group published a target list on its Telegram channel.

While highly visible and aimed at maximum psychological impact, DDoS attacks are mostly a noisy nuisance, different from hacking that involves breaking into networks and can do serious damage.

“We noticed this morning that the external website was down, and our IT and security people are in the process of investigating,” said Andrew Gobeil, a spokesman for Atlanta’s Hartsfield-Jackson International Airport. “There has been no impact on operations.”

Portions of the public-facing side of the Los Angeles International Airport website were also disrupted, spokeswoman Victoria Spilabotte said. “No internal airport systems were compromised and there were no operational disruptions.”

Spilabotte said the airport notified the FBI and the Transportation Security Administration, and the airport’s information-technology team was working to restore all services and investigate the cause.

Several other airports that were included on Killnet’s target list reported problems with their websites. Orlando International Airport told CBS News that its site was affected but is back online and that airport operations were not impacted.

The Chicago Department of Aviation said in a statement that websites for O’Hare International and Midway airports went offline early Monday but that no airport operations were affected.

“Early Monday, FlyChicago.com and related websites for O’Hare and Midway international airports went offline. No airport operations were affected. City of Chicago IT staff worked diligently to restore the website’s functionality shortly after noon CT, and they continue to vigilantly monitor the situation. The City’s Information Security Office at the Department of Assets, Information and Services is investigating the cause of the outage,” the department said in a statement.

Last week, the same group of hackers claimed responsibility for denial-of-service attacks on state government websites in several states.

John Hultquist, vice president for threat intelligence at the cybersecurity firm Mandiant, tweeted that denial-of-service attacks like those aimed at the airports and state governments are usually short in duration and “typically superficial.”

“These are not the serious impacts that have kept us awake,” he said.

Such attacks instead tend to reveal insufficient attention by webmasters to adequate bulletproofing of sites, which now includes DDoS protection service.