An Analysis of Worldwide Cybercrime in 2021-2022

Which Industry Is the Most Targeted and Why?

Based on the table above, the information industry has suffered the most data breaches in the recorded 1-year period.

You know it by another name – the Information Technology sector, or IT for short. This includes a wide range of companies like Amazon, Microsoft, Google, Apple, and others.

These are companies that deal with information. They create it, gather it, process it, and distribute it.

Telecommunications companies, computer programming, system design, market research, testing, all of this is part of the information industry.

And hackers know that information is the most important asset in the 21st century. Think about it – what keeps your banking account secure? A username, a password, the bank’s security system. All of this is information.

Simply knowing that information gives you access to people’s entire livelihoods. Social media platforms also fall in the Information sector, and they’re notorious targets for cybercriminals for the same reason – information gathering.

Here are a couple of reasons why the Information sector is the most attractive target for cybercriminals:

1. Risk-Taking and Innovation

IT companies will often be at the forefront of technological advance, which means that they push boundaries and take risks.

New technologies often take the brunt of cyberattacks because there’s a higher chance that they have undiscovered security vulnerabilities.

Moreover, companies may cut some corners to go public with the new technology sooner. This could mean more bugs and more vulnerabilities.

2. Valuable Data

When it comes to data theft, hackers look for two things:

• Personally Identifiable Information (PII)
• Intellectual Property (IP)

And tech companies deal in just that. They often sell software to clients or hold their personal and financial data for access to their services and software.

This could mean credit card details, access credentials to accounts, and other valuable personal data that will fetch a good price on the dark web.

To get their hands on this data, hackers go to any length and use any methods available. Social engineering is often the most preferred tactic for data theft.

3. Cloud Technology

The advantage of cloud technology is clear – it allows for seamless collaboration with teams across the world, and the sharing of resources quickly.

However, cloud technology is also notorious for its data leaks and wonky security configurations. This often leads to leas of sensitive data publicly.

The fact that cloud technology connects multiple individuals or companies together also poses an inherent risk. If they hack the cloud, cybercriminals get access to all the business networks operating on it.

4. Supply Chains and Company Interconnection

IT companies often work with other third-party companies to establish a supply chain for the materials required to build their products.

This opens the way for supply-chain attacks, where infiltrating one company provides sensitive data on several other companies across the supply chain.

Software vendors are some of the most attractive targets to hackers, for instance. They fit the bill perfectly – they create a product for which they need materials (physical or digital).

And they get these materials from third-party entities.

5. Open-Ended Architecture

The IT industry is a fast-paced ecosystem where innovation relies on boundless creativity and freedom of expression.

To get that creativity, IT firms often implement remote work to find talents from around the world. This means a more open-ended architecture that leaves them vulnerable to attacks.

Remote work increases the attack surface and makes it harder for companies to establish good security for all employees.

It’s more difficult to ensure that your employees secure their devices accordingly and are aware of the risks involved.

What Is the Most Common Cybercrime Method?

The most common cybercrime method is phishing, according to a Statista study. Here are the most commonly-reported cybercrime methods in the US as of 2022:

There have been over 300,000 cases of reported phishing cases in 2022 in the US. That’s a single country out of 66 first-world countries.

Moreover, according to the World Economic Forum and the US Department of Justice, over 85% of all cybercrime goes unreported within organizations.

This means that the reality of cybercrime is much more grim than we thought. It’s one of the most spread-out sicknesses of the 21st century.

Why Is Phishing So Prevalent?

Phishing is incredibly common for a few key reasons:

Users lack security awareness

Lack of employee training is the number one reason why phishing tactics succeed. Security awareness should be mandatory to every company operating online, whether they’re handling sensitive data or not.

When employees don’t know what ransomware is or how a suspicious email looks like, they’re going to make mistakes that cost you hundreds of thousands of dollars in data theft. Or worse…

Fortunately, it seems that security awareness training has become more common across companies. An Osterman research study found companies have allocated more time to training employees on cybersecurity in 2021 compared to 2020.

For instance, in 2021, there are 4% of employees receiving zero security awareness training, compared to 12% in 2020. That’s a 66% increase in security awareness training.

Personal costs a lot on the dark web

If you’ve checked out our Dark Web Price Index in 2023, then you know just how valuable personal data is on the dark web.

A hacked Gmail account goes for $60, a hacked Facebook account costs around $25, and a Binance verified account goes for $410.

Information is expensive these days, and there are plenty of people willing to buy it. Consequently, you’ll always find criminals willing to sell it.

Tripwire claims that the cybercrime industry rakes in more profits than the drug trade.

Companies aren’t taking enough precautions

Many companies simply overlook the risk of phishing attacks. They don’t have enough backup processes in place to pre-mitigate a data theft situation, for instance.

They also fail to identify their least-aware employees that might need more training and awareness.

Technical security measures are also lacking for some companies. Take double confirmation for bank transfer requests, for instance. It would mitigate CEO fraud quite easily. But you don’t see it too often implemented.

Cybercriminals are well-funded

This might be counterintuitive but many cybercriminal groups are quite rich. Some statistics claim that they make up to $7,500 per month, which is more than enough to give them leeway in the attacks they commit.

With this much money, hackers can increase the number of attacks they carry out and prepare more sophisticated tactics.

They also have enough funds to hone their technical skills, learn new tricks, and increase their earning potential.

Cheap phishing tools

Hacking someone has never been cheaper as in 2023. The emergence of RaaS (ransomware-as-a-service) has completely changed cybercrime.

Criminals now have easy access to complex tools that they can use to carry out attacks on individuals and companies like.

Phishing kits are readily available and relatively cheap given the money-making potential they bring.

We have to face it – phishing is a lucrative business in 2023, and it’s no surprise we’ve seen an increase in the number of phishing attacks.

More sophisticated phishing programs

Have you heard about ransomworms? They’re a nasty piece of software that’s already made many victims.

It’s a self-replicating ransomware, basically. Regular ransomware programs can be easily eliminated from systems.

Not the ransomworm, though. They not only infiltrate systems faster but they’re much harder to destroy. The program keeps multiplying itself, hijacking whatever system it’s put in.

Is There Something We Can Do?

Certainly, there are many things we can do. For starters, we should become more aware of our surroundings when going online.

That link with a strange-looking URL? Indeed, it’s most likely a phishing attempt. Accessing a public Wi-Fi network? You’d rather not. They’re honeypots for hackers.

That password you reuse for half of your online accounts? It’s one of the worst things you can do in terms of online security.

We at Privacy Affairs strongly believe that being proactive is better than being reactive when it comes to cybersecurity.

It’s preferable to not have to react at all thanks to an airtight security system, rather than reacting to an attack after it occurs.

Make no mistake – cyber criminals employ increasingly sophisticated tools. But cyber-defense is also evolving at a rapid pace.

There are more and more tools you can use to defend yourself from data breaches:

• Password managers like 1Password
• End-to-end encrypted email providers like ProtonMail
• Two-Factor Authentication (2FA) security keys like YubiKey
• Virtual Private Networks (VPNs) like NordVPN
• Virtual card services like Privacy.com
• Premium antimalware software like Norton

I use four of the tools on this list myself. They’re a good step in the right direction but you still have to implement good online practices and common sense.

Nothing can replace data privacy and cybersecurity education!

Sources

Statista – Global Number of Cyber Crime Incidents from November 2021 to October 2022, by Industry and Organization Size
Cybersecurity Ventures – Cybercrime to Cost the World $10.5 Trillion Anually by 2025
Wired – Want Job Security? Try Online Security
Privacy Affairs – Dark Web Price Index 2023
Privacy Affairs – The Art of Cyber Deception: Social Engineering in Cybersecurity
Insights Carnegie Mellon University – 12 Risks, Threats, & Vulnerabilities in Moving to the Cloud
Privacy Affairs – Cybersecurity Deep Dive: What Is a Supply-Chain Attack?
Statista – Most Commonly Reported Cyber Crime Categories in the United States in 2022, by Number of Individuals Affected
Anapaya – The Unseen Problem of Unreported Cybercrime
Privacy Affairs – Why Is Phishing so Common & How to Protect Against It?
Osterman Research – Security Awareness Training as a Key Element in Changing the Security Culture
TripWire – Cybercrime and Money – Cause and Effect
PrivacyAffairs – Cybersecurity Deep Dive: What Is Cybercrime-as-a-Service?
Hotspot Shield – Ransomworm – A Threat Worse than Ransomware