According to Henry Ford, “The only real mistake is the one from which we learn nothing.” In that spirit, let’s learn about cybersecurity by looking back at the significant data breaches of 2023 and analyzing what went wrong.
By taking a short quiz about last year’s top data breaches, we can better understand cybersecurity vulnerabilities and implement more robust strategies. Answers are revealed at the end of the quiz.
1. MOVEit data breach
The 2023 MOVEit data breach was a massive cyberattack orchestrated by the hacker collective CL0P. The group exploited a zero-day vulnerability in the file transfer application by executing a sophisticated SQL injection technique, allowing them to steal files from many entities, including financial institutions, government bodies, and pension funds.
Question: The MOVEit data breach affected which of the following organizations?
- Shell
- Johns Hopkins University
- American Airlines
- US Department of Energy
- All of the above
2. ChatGPT data breach
The security breach involving ChatGPT happened on March 20, 2023. It stemmed from a vulnerability in the company’s Redis open-source code, leading to the exposure of information belonging to ChatGPT Plus subscribers. The compromised data included personal names, email addresses, billing addresses, credit card information, and more.
Question: What was the first response of OpenAI, the developer of ChatGPT, to address the breach?
- Reported the breach to the proper authorities
- Shut down ChatGPT temporarily
- Replaced their Redis open-source with a different one
- Notified affected users about their information being potentially exposed
- Sent a patch to the maintainers of the Redis client open-source library
3. Activision data breach
The Activision data breach started on December 4, 2022, when hackers successfully executed a phishing attack on an Activision employee. This led to cybercriminals stealing employees’ personally identifiable information, including full names, phone numbers, work locations, and salaries, as well as detailed company plans for the coming year. The breach extended to the company’s Slack account, with the stolen data subsequently ending up shared on X (formerly Twitter).
Despite the breach occurring in December, Activision did not notify its employees until months later, when vx-underground, a cybersecurity and malware research group, exposed the incident. While vx-underground said the attack compromised sensitive workplace information, Activision maintained that no sensitive employee data, player data, or game code had been accessed.
Question: Which of the following statements is true?
- Cybercriminals prefer to target big corporations.
- Victims of a cyberattack should report it once they identify the attacker.
- Installing a password manager guarantees network security.
- Humans are a network’s weak points.
- Companies can refuse to disclose breach information to avoid loss of public trust.
Answers to the quiz
Find out if you got the correct answers to the questions about the top 2023 data breaches.
1. Answer: E – All of the above
The MOVEit data breach hit tens of millions of individuals, impacting state and federal agencies, pension funds, financial firms, nonprofits, and more. Globally, thousands of organizations were affected, and the fallout is still ongoing. The long-term impact of the breach is still unknown, and the total number of people whose data has been stolen is expected to increase.
The MOVEit breach stemmed from a previously unknown vulnerability. To prevent a similar incident from happening to your business, implement the following security measures:
- Regular software updates: Continuous software updates will apply the latest security patches, mitigating zero-day vulnerabilities not unlike those exploited by the CL0P hacker group.
- Data encryption: Implementing robust data encryption bolsters security measures, making it significantly harder for hackers to access and pilfer sensitive information.
- Comprehensive vulnerability assessments: Regular and thorough vulnerability assessments enable organizations to identify and rectify potential security weaknesses before these are exploited.
- End-to-end encryption: Implementing end-to-end encryption for data at rest and in transit significantly enhances security, reducing the likelihood of interception and theft of sensitive information by hackers.
2. Answer: B – Shut down ChatGPT temporarily
Upon discovering a bug, OpenAI immediately halted ChatGPT operations to prevent additional damage. Once the bug was identified, OpenAI swiftly developed a patch and forwarded it to the Redis maintainers to address and resolve the issue.
How might OpenAI have averted this breach caused by a bug in the Redis open-source library?
- Regular security audits: Consistently review data security measures to proactively spot and rectify potential vulnerabilities before they pose a threat.
- Bug bounty program: Establish a system where users and researchers are incentivized to report possible vulnerabilities, which OpenAI did in their breach response.
3. Answer: D – Humans are a network’s weak points
As the Activision data breach shows, an employee clicking on a phishing link is enough to allow cybercriminals to infiltrate a company’s systems. This breach therefore reminds us of the importance of continuous employee training and awareness to prevent phishing attacks.
Another lesson that we can take from the Activision breach is to always act with urgency and transparency in the event of a breach. Activision delayed notifying its employees and the public about the breach — something that a company should never do in Canada, where businesses are mandated to report a breach and inform all affected parties.
Did you do well in the quiz? If you find keeping up with technology a little overwhelming, don’t worry. Let our experts at XBASE handle your IT and help you keep up with the ever-evolving nature of technology and cyberthreats. Take the first step toward a more secure cybersecurity posture — contact us today.