Top Security Breaches and Cyber Attacks happened in 2024

2024 witnessed a surge in cyberattacks, causing significant disruption. This list highlights major security breaches that made headlines.

• Microsoft Executive Accounts Breach: A sophisticated attack compromised the accounts of several high-ranking Microsoft executives, raising concerns about the company's internal security.

• Volt Typhoon Attacks: This state-sponsored cyberespionage group targeted critical infrastructure in the United States, including telecommunications companies.

• Change Healthcare Ransomware Attack: A major healthcare provider fell victim to a ransomware attack, disrupting patient care and potentially exposing sensitive medical information.

• Snowflake Customers Targeted: Threat actors exploited vulnerabilities in customer accounts to gain access to sensitive data stored on the Snowflake cloud platform.

• CDK Global Attack: A ransomware attack impacted the automotive retail software provider CDK Global, disrupting dealership operations across the United States.

• Salt Typhoon Attacks: Another state-sponsored threat actor, Salt Typhoon, targeted government and private sector organizations in Southeast Asia, raising concerns about regional cyberespionage.

• Blue Yonder Ransomware Attack: The supply chain software provider Blue Yonder was hit by a ransomware attack, impacting its operations and potentially disrupting supply chains for various industries.

• Network Device Attacks: Threat actors increasingly targeted network security devices like firewalls and VPNs, compromising critical entry points into organizations' IT environments.

• Ivanti VPN Attacks: A series of attacks exploited vulnerabilities in Ivanti's Pulse Secure VPN, allowing attackers to gain unauthorized access to corporate networks.

• Multiple Ransomware Attacks on Healthcare Providers: The healthcare sector continued to be a prime target for ransomware attacks, with numerous hospitals and clinics facing disruptions and data breaches.

• XZ Utils Backdoor: In February 2024, a malicious backdoor was introduced to the Linux build of the xz utility within the liblzma library in versions 5.6.0 and 5.6.1 by an account using the name "Jia Tan". The backdoor gives an attacker who possesses a specific Ed448 private key remote code execution capabilities on the affected Linux system. The issue has been given the Common Vulnerabilities and Exposures number CVE-2024-3094 and has been assigned a CVSS score of 10.0, the highest possible score.

• RegreSSHion: The OpenSSH vulnerability CVE-2024-6387, also known as "regreSSHion", was discovered on July 1, 2024. It's a critical security vulnerability that allows remote attackers to execute code as the root user.

• Pollyfill Supply chain attack: On June 25, 2024, Sansec's forensics team reported a major supply chain attack targeting the Polyfill.io JavaScript library. This service provides polyfills to enable web applications to function across different browsers, with the code hosted and delivered via a CDN.

• CVE-2024-55591: Fortinet Authentication Bypass Zero-Day Vulnerability: CVE-2024-55591 is an authentication bypass vulnerability in FortiOS and FortiProxy. An unauthenticated, remote attacker could exploit this vulnerability by sending a specially crafted request to a Node.js websocket module. Successful exploitation may grant an attacker super-admin privileges on a vulnerable device. According to the Fortinet advisory, this vulnerability has been exploited in the wild.

Key Takeaways:

• Ransomware remains a persistent threat: 2024 saw a continued rise in ransomware attacks, with attackers targeting critical infrastructure, healthcare providers, and businesses of all sizes.

• State-sponsored actors are a growing concern: Sophisticated nation-state actors are increasingly targeting critical infrastructure and government agencies for espionage and disruption.

• Supply chain attacks are on the rise: Attackers are exploiting vulnerabilities in third-party vendors and software to gain access to their targets.

• The need for robust cybersecurity defenses is paramount: Organizations of all sizes need to invest in strong cybersecurity measures, including regular security assessments, employee training, and robust incident response plans.