Australia’s rising number of cyber attacks

Recent years have seen the continued widespread adoption of new technology across various organisations and industries. From sole traders to larger organisations, digitisation is seen as a way to increase efficiency, reduce cost, provide key data points and improve the overall customer experience. Through the COVID pandemic, digitisation provided key resilience to many sole traders and small businesses, helping them stay open and thrive through shifting lockdowns and uncertainty.

Unfortunately, there have been a number of high-profile cyber attacks in recent times, on companies such as Optus, Medibank, Woolworths and Vinomofo. What we’ve learned in the aftermath of these events is that not all data breaches are the same, and not all companies treat them in the same way. With these cybercrimes being played out in the public domain, these organisations have inadvertently presented themselves as case studies for others.

Organisations cannot avoid cyber attacks entirely. Perpetrators will look for and exploit any vulnerability they find. Preparation and resilience to recover from a cyber attack will define how well an organisation recovers and how much damage the attackers can do.

According to the Australian Cyber Security Centre’s (ACSC) Annual Cyber Threat Report, July 2021 to 2022, there has been a heightened level of malicious cyber activity in Australia, with reported cybercrime up nearly 13 per cent from the previous financial year. The report also shares that the average loss per report across organisations rose 14 per cent compared to the previous year.

Is Australia an attractive target for cybercriminals?

The Cyber Security Industry Advisory Committee’s (IAC) Annual 2022 report, published in August 2022 states that the global cyber threat environment has intensified over the last twelve months, and Australia has proved a lucrative hunting ground for malicious actors and cyber criminals. In 2021, Australia ranked fourth in the top 10 countries ranked based on cybercrime victims per capita, falling behind the United Kingdom, United States and Canada.

IAC highlights the adoption of new technologies, increased online presence, higher number of individuals working from home because of the pandemic, along with increased geopolitical tensions as contributors to the greater number of attacks on the Australian network.

This appears to be in line with the ACSC report indicating that the most frequent reported crimes were online fraud, online shopping and online banking.

The methods used and what to do

Ransomware is one of the more attractive modes of attack for cybercriminals as they attempt to glean as much money as they can by selling off company data or by getting a ransom. It is opportunistic in nature – ransomware is about installing malware on devices and servers to encrypt data or restrict access to key systems is damaging, and using that to extort money from victims, and releasing stolen data if the ransom is not paid.

While it appeared to account for a small percentage of reported cybercrime, ACSC considers that it is potentially the most destructive as it impacts the organisation, its business and reputation, employees and customers.

While top tier ransomware groups target larger, high profile, high value organisations, trends indicate that there is a shift towards targeting small and medium size businesses.

The question for organisations, no matter the size – is should you pay?

In part, organisations feel that they have to because they feel that they have no choice. Law enforcement agencies however make the recommendation not to. As the saying goes, ‘do not negotiate with terrorists’ – the main argument not to pay is that it creates a revenue stream for the perpetrators of the attack, and there’s no guarantee that you will get your data back, or that you won’t be attacked again.

This debate, however, may be off the table with Home Affairs Minister and Cyber Security Minister Clare O’Neil confirming that the government is examining if new laws are required to stop ransom payments.

PEXA Customers can learn more on how to keep devices secure in our Computer Security Help Centre article. 

How to protect yourself from a cyber attack

David Willett, PEXA Chief Information Security Officer says that ‘cyber hygiene is not different from personal hygiene. We practice personal hygiene, like washing our hands, as it gives us the best chance possible of not getting ill. Cyber hygiene is exactly the same. While there’s no silver bullet to removing the risk of a cyber attack – it gives you the best chance possible of removing that risk.”

Good cyber hygiene comes down to the basics and some of them include:

• Having an up-to-date antivirus software installed
• Use a password manager and have strong, unique passwords for important services,
• Ensure that your devices and applications have updated software or patches and automate them where possible
• Do not use public wi-fi
• Think before you click! Learn and understand red flags in any email or SMS
• Ensure that you have multi-factor authentication everywhere
• Stay informed on cyber risks and how they relate to you
• Implement these steps at work and at home
• And share what you know with friends and family.

“People should not feel embarrassed falling victim to a cyber attack. Cybercriminals are highly organised groups of people who have a global reach and make it their mission to fool people. The best thing you can do if you think you have fallen victim is to report it to the right people over in your IT support or whoever is responsible for cyber security in your organisation because time is of the essence when it comes to this situation.” David adds.

“It’s also important to keep yourself well educated on what’s going on in the cyber crime sphere. No longer do we have the luxury of waiting for information to be provided, we need to go out and find this information ourselves. Because this really is everyone’s responsibility. Everyone can be a target and it affects us all equally.”