Bad actors continue to look for industries that they can easily steal data from, while getting a handsome payout. While manufacturing may not be the first industry to come to mind, it is turning out to be a gold mine for hackers. Sikich’s 2020 Manufacturing and Distribution Report found that nearly half of the respondents had experienced cyberattacks in the last year – and that less than 40% execute data breach prevention activities, including penetration testing, phishing exercises on employees, and assessments of vendor’s data security efforts.
“Cybercriminals have moved on from focusing primarily on organizations rich in sensitive personal data, such as financial or health care institutions,” said Brad Lutgen, partner-in-charge of Sikich’s cybersecurity practice. “Instead, they target any organization with IT weaknesses and attempt to turn a profit through ransomware and other cyberextortion techniques.”
It is very costly for a manufacturer when they are attacked – not only can it force the closure of one or more plants but a cyberattack can expose sensitive data, compromising customers and the corporate brand, while resulting in a failure to fulfill customer orders. It is very important that companies are aware of the different cyber threats, and how to protect their data.
“Manufacturing requires significant uptime in order to meet production and any attack that causes downtime can cost a lot of money. Thus, they may be more inclined to pay attackers,” Selena Larson, intelligence analyst for Dragos said.
Major Attacks
Verizon reported in its 13th annual Data Breach Investigations Report that 73% of attacks launched against the manufacturing sector were motivated by financial reasons, with the balance involving espionage. These statistics are not surprising, since manufacturers process a lot of sensitive data including customer’s payment information, addresses, and non-disclosure agreements. Below are just a few examples of cybersattacks on manufacturers:
-
Mondelez
Mondelez, a multinational food and beverage company, was hit by an attack that leveraged the encrypting malware NotPetya. The attack permanently damaged 1,700 servers and 24,000 laptops and cost the company $100M, while also impacting production.
-
OXO International
OXO, an industrial goods manufacturer, found malicious code on its website, which was designed to steal data from the company’s checkout page. Customer data, including payment card information and addresses, were stolen. It has not been reported how much the breach cost.
-
Visser Precision
Visser Precision, a space and defense manufacturer, was hit with an attack using DoppelPaymer ransomware. The attack leaked sensitive data, which was published on a hacker’s website created to publicize the list of files stolen in the attack. Files included non-disclosure agreements with Tesla, SpaceX, and General Dynamics, and a Lockheed Martin schematic for a missile antenna. Costs of the breach were not reported.
Threat Vectors
There are many cyber threats out there and it can be a challenge considering how to protect your company from all of them. We’ve compiled a list of some of the most common threat vectors – and what to look for.
Phishing and Spear Phishing Attacks
Fraudulent emails are one of the oldest tricks in the book of hacking — and this time-tested cybercrime continues to evolve. Cybercriminals are now using AI to boost their phishing activities, creating more realistic and deceitful emails and sending them in unprecedented numbers.
In a spear phishing attack, fraudsters specifically target an employee of an organization who holds key log-ins or other critical information. The best way to avoid becoming the target of a spear phishing attack is through regular employee training that teaches best practices in data security.
Cloud Vulnerability
More organizations than ever are using cloud applications and storing private data from their employees, operations and transactions on the cloud. In fact, in 2020, 93% of enterprises used a multi-cloud strategy.
For hackers, the cloud presents new opportunities to get away with valuable data. Some of the most common threats to data security on the cloud are insider threats, misconfiguration, insecure interfaces and APIs, and DDoS attacks. While cloud companies are evolving their data security, they are still vulnerable to deep cyber attacks, like Operation Cloudhopper, which successfully targeted Hewlett Packard and IBM in 2018.
Vendor Vulnerability
In 2020, SolarWinds made the news with their massive supply chain attack. It is reported that 18,000 organizations were affected, costing billions of dollars. This is a great example that if one of your vendors has a vulnerable system, your company is at risk of their data being compromised. It doesn’t appear that supply chain attacks are slowing down either, with an increase of 78% since 2019.
It is crucial that companies and their vendors are protecting their data and taking the necessary steps to devalue that data.
Ransomware Attacks
Ransomware has become a favorite of fraudsters, and it is projected that in 2021, a ransomware attack will occur every 11 seconds. The average ransom is $233,17, and there is no guarantee that paying the ransom will secure your data.
To prevent becoming a victim of a ransomware attack, don’t click on unverified links, never open untrusted email attachments, and use mail server content scanning and filtering
Human Error
According to Verizon’s 2020 DBIR, 22% of data breaches occurred as a result of human error. Falling for a phishing email, sending information to the wrong person or accidentally leaving a database online without any password restriction are just a few of the ways that a small mistake can turn into a data security disaster.
The best way to prevent these mistakes? Regular and thorough data security training for employees.
Secure Your Companies’ Data
Cyberattacks in manufacturing show no signs of slowing – but you can quickly and effectively “devalue” your data using Bluefin’s payment and data security products.
Our manufacturing security suite includes PCI-validated point-to-point encryption (P2PE) for contactless face-to-face, call center, mobile and unattended payments, and our ShieldConex® data security platform for the protection of sensitive data entered online.
Contacts us to learn more about how Bluefin can help devalue your sensitive data, reduce PCI compliance scope, meet data privacy regulations and protect your brand.
And for more information on Bluefin’s solution, attend our upcoming webinar, in partnership with Bright Lion, on “Securing Manufacturing and Wholesale Supplier Payments with Bright Lion’s Zencurity™ PCI-validated P2PE Solution” at 2 PM EST on May 4th, 2021.
