Data crime
The headlines are scary.......
Strava users sharing sensitive data from US bases targeted by Iranhttps://news.sky.com/share/13570458
AI and nuclear war threaten human extinction by 2100, report warns
UK floods taskforce told to start looking at drought
The gateway to a world that 'exposes children to unimaginable harm'
None of this builds confidence! If you need sensor data away from vulnerabilities of the internet, servers, gateways and apps …. Away from cyber threat ! Ask Tigertek….
How scared should we be about AI? Minister gives his verdict https://news.sky.com/share/13598246
Recent financial and major corporate data breaches highlight an escalating wave of cyberattacks targeting banks, credit institutions, and wealth management firms through autumn 2026:
South Korean Financial Sector Breaches (October 2026): Multiple major South Korean financial institutions—including Shinhan Bank, KB Kookmin Bank, Hana Bank, Busan Bank, Y가рам (Yegaram) Savings Bank, Welcome Savings Bank, and Hyundai Capital—suffered coordinated hacking incidents. Shinhan Bank confirmed the leak of sensitive details (names, phone numbers, and annual incomes) for roughly 25,000 customers, while authorities expanded investigations to stock brokerages and insurance companies. [1, 2]
MG Community Credit Cooperatives (October 2026): The federation disclosed a second-wave hacking attack using overseas IP addresses that exposed 12 categories of sensitive financial data (including encrypted resident registration numbers, account numbers, and balances) for around 400 insurance customers, pushing total victims across South Korean financial entities past 1 million. [1]
Goldman Sachs and Man Group via EY Breach (October 2026): Clients of Goldman Sachs' wealth management division and the UK-listed hedge fund Man Group were caught up in a major third-party data breach affecting EY (Ernst & Young). [1]
ASOS Cyberattack (October 2026): The online fashion and retail giant suffered a high-profile breach where hackers breached customer databases and directly messaged thousands of customers to engage with ransom demands, intensifying scrutiny on retail data protection. [1]
Bank Sepah Extortion (March 2025): Bank Sepah experienced a significant data exposure involving 1 million records and a $42 million extortion demand. [1]
How do criminals do it ?
Criminals use a variety of sophisticated technical and psychological tactics to breach networks, compromise devices, and steal sensitive information. These methods generally fall into several main categories: [1, 2]
1. Social Engineering (Manipulating People)
Instead of hacking code, criminals frequently exploit human psychology to gain access to restricted data. [1, 2]
Phishing: Deceptive emails, text messages (Smishing), or phone calls (Vishing) designed to mimic trusted organizations (like banks or tech support). They trick victims into revealing passwords or clicking malicious links. [1, 2, 3]
Spear Phishing & Whaling: Highly targeted attacks tailored to a specific individual (like an HR manager) or high-ranking executive (Whaling) to gain high-level corporate access. [1, 2]
Baiting & Pretexting: Leaving malware-infected physical media (like a USB drive) for someone to find, or inventing a fake scenario (pretext) to manipulate a target into sharing account access. [1]
2. Password and Credential Exploitation
Brute-Force & Dictionary Attacks: Automated software systematically guesses combinations of characters or common dictionary words until it cracks a password. [1, 2]
Credential Stuffing: Using automated scripts to test leaked username and password combinations from past data breaches across completely unrelated websites, exploiting the common habit of password reuse. [1, 2, 3]
Password Spraying: Testing a single, highly common password (like "Password123") across thousands of different user accounts on a system to avoid triggering account lockout rules. [1, 2]
3. Malware Deployment
Malicious software (malware) is designed to operate in stealth to infect devices and extract or manipulate data. [1, 2]
Ransomware: A highly destructive strain that encrypts a victim’s files or locks their network, holding the data hostage until a cryptocurrency ransom is paid. [1, 2]
Keyloggers: Spyware that records every single keystroke made on a physical keyboard or touch screen, allowing hackers to harvest typed passwords, credit card numbers, and personal messages silently. [1, 2]
Remote Access Trojans (RATs): Malware disguised as legitimate software that secretly grants criminals full control over a system, enabling them to hijack webcams, read messages, and browse files. [1, 2]
4. Technical and Network Interception
Criminals exploit structural software flaws or insecure network configurations to access data in transit. [1, 2]
Man-in-the-Middle (MitM) Attacks: Intercepting and sometimes altering data traveling between two parties. A common method is setting up a rogue public Wi-Fi hotspot with a name matching a legitimate venue (known as an Evil Twin attack) to capture unsecured data traffic.
Exploiting Unpatched Vulnerabilities: Scanning systems for outdated software or hardware firmware to compromise databases through unfixed security flaws or Zero-day exploits.
Code Injection (e.g., SQL Injection): Inserting malicious code or commands into web forms or unvalidated database inputs to force a server to dump proprietary backend database records.
Supply Chain Attacks: Compromising a trusted third-party software vendor to inject malicious code into standard, verified software updates, letting the attack instantly spread to thousands of unsuspecting downstream customers. [1, 2, 3, 4, 5]
What do criminals use stolen data for ?
Cybercriminals use stolen data primarily to make money, commit fraud, or trade it with other bad actors. [1, 2]
Financial Fraud: Criminals use stolen credit card numbers, bank details, or PINs to make unauthorized purchases, drain accounts, or transfer funds. [1, 2]
Identity Theft & Impersonation: Using names, addresses, and national IDs or Social Security numbers, they open fake bank accounts, take out loans, or file fraudulent tax and benefit claims. [1, 2, 3]
Account Takeovers: With stolen login credentials, they break into email, social media, or e-commerce accounts to steal saved payment methods or lock the real owner out. [1, 2]
Dark Web Sales: Stolen records are packaged and sold in bulk on underground dark web marketplaces to other criminals. [1, 2, 3]
Phishing & Social Engineering: Personal details are weaponized to craft hyper-personalized scam emails, text messages, or phone calls that trick victims into giving away even more sensitive information. [1, 2]
Extortion & Blackmail: In cases involving sensitive medical, corporate, or private data, criminals threaten to leak or publish the files unless a ransom is paid. [1, 2, 3]
Corporate Infiltration: Stolen employee login credentials or client lists are used to breach business networks, commit vendor fraud, or steal intellectual property. [1, 2]
You can check if your personal details have appeared in known breaches using tools like Have I Been Pwned. [1]
