Black Friday and Cyber Monday are the perfect opportunities to grab someone special a unique gift at a discount.

However, it’s also prime time for scammers.

The rush to purchase presents under time pressure can also leave you more vulnerable, making you or your loved ones an easy target for cyber scams.

With the Black Friday sales fast approaching, it’s important to be aware of the potential cyber risks to stay safe online.

This blog will highlight the scams that may emerge and what you can do to stay safe while online shopping.

Let’s get into it.

Recognising cyber threats

Phishing attacks:

During the Black Friday sales, we often see an increase in phishing emails. Cybercriminals impersonate trusted brands, enticing you to click on malicious links or provide sensitive information.

For example, an ‘Amazan.com’ offer for iPads at outstandingly low prices.

Be cautious of unexpected email offers and verify their email addresses, also remember to pay close attention to spelling.

You’ve heard the saying, if it seems too good to be true it probably is! If you are unsure, you can look a company up on the Better Business Bureau website, and check their Scam Tracker for any reported issues.

Being vigilant with your emails allows you to benefit from genuine discounts and steer clear from the scams.

Fake websites:

Ever been on a website and thought something about it seemed a little off? Be aware of fake websites; hackers often create close clones of popular sites to trick users into handing over sensitive information or their hard-earned money.

Scammers typically start by copying the layout and design of a legitimate retailer’s website, making their fake site appear convincing at first glance.

They may also use domain deception, registering web addresses that closely resemble those of well-known brands.

These fake websites often dangle enticing offers that appear too good to pass up, drawing in unsuspecting shoppers.

Additionally, some of these deceitful sites may distribute malware. Clicking links or downloading files from them can infect your device with malicious software.

Staying informed and vigilant is your best defence against these online tricks, especially during events like the Black Friday sales.

Fake mobile apps:

Scammers create fake shopping apps that mimic popular brands. These apps can be found on unofficial app stores or through deceptive links.

Downloading these apps could lead to malware infections or theft of your personal information.

Stick to official app stores and read reviews before downloading any apps. Sometimes scammers will post fake reviews on their app to make it appear legitimate, so check the dates of reviews goes a long way.

Third-party sellers:

When purchasing from online marketplaces, exercise caution with third-party sellers.

Some sellers may not be as reputable as they appear, potentially leading to fake or flawed products.

Check reviews and seller ratings, and try to purchase from established retailers.

Social media scams:

Social media is a powerful tool for scammers.

They can dangle enticing offers or extravagant contests with the promise of winning valuable prizes.

However, it’s essential to remember that the price of these so-called “prizes” might be your valuable personal information, as scammers may request certain details to enter.

How to stay safe on Black Friday and Cyber Monday

Now that you’re aware of the potential cyber risks and the scams that could crop up during the sales, here are 10 practical steps to keep yourself safe:

1. Verify website URLs: Always double-check the web address before making a purchase. Make sure it matches the retailer’s official website. Cybercriminals often use similar but slightly altered web addresses to trick shoppers.
2. Look for ‘https://‘ and the padlock symbol: Ensure the website you’re using has ‘https://’ in the address bar, along with a padlock symbol. This indicates a secure connection and protects your data during transactions.
3. Check for verification: When following deals or promotions from social media accounts, look for a verification badge on their profile. This confirms their authenticity. Beware of impersonators who lack this verification.
4. Verify email offers: Don’t be tempted by unexpected email offers that seem too good to be true. Before clicking on any links or sharing personal information, verify the sender’s email address and double-check the spelling. Scammers often use slight variations to mimic legitimate brands.
5. Official apps and websites: Stick to official app stores and trusted websites when purchasing or downloading apps. Read reviews and ratings to ensure you’re dealing with reputable sources.
6. Two-factor authentication: Whenever possible, enable two-factor authentication (2FA) for your online shopping accounts. This additional layer of security ensures that even if your login details are compromised, your account remains protected.
7. Bad spelling and writing: Real websites use proper words and sentences. If you see lots of mistakes, it’s likely a fake website.
8. Blurry pictures: Genuine shops use clear pictures of their products. If the pictures are blurry or look otherwise strange, it’s a warning sign that the website might be fake.
9. Beware of overly aggressive pop-up ads: Scammers often use aggressive and persistent pop-up ads that claim you’ve won something or offer unbelievable discounts. Legitimate websites typically don’t bombard you with constant pop-ups. If it seems too intrusive or too good to be true, it’s likely a scam. Close the pop-up and continue your shopping on trusted websites.
10. Stay informed: Keep yourself informed about common online scams and cybersecurity best practices. Being aware of potential threats empowers you to recognise and avoid them.

How Bob’s Business can help your team build cyber awareness

Cyber deals can be attractive, but if your employees get trapped in online scams during these events, it can impact your company’s cybersecurity.

Some employees might not be too cautious with their passwords, and when their personal and work data blend, it poses a security challenge, especially for those who work remotely.

Bob’s Business is here to help with our cybersecurity awareness eLearning training, ensuring your employees can identify and address online threats efficiently and effectively.

We also offer tailored solutions to suit your unique business blindspots – Why not click here to explore our courses designed to ensure the safety and security of your business?

And happy shopping!

It’s Cybersecurity Awareness Month, and, as is tradition, Microsoft has moved to release their Digital Defense Report. This year, they’re reporting on the period between July 2022 and June 2023, crunching the numbers and attempting to solidify an ever-changing threat landscape.

The report, across 131 pages, touches on the state of cybercrime, nation-state threats, the crucial cybersecurity challenges that all companies face and more.

In this blog, we’ll pull together some of the highlights and showcase some of the cybersecurity learnings that businesses need to know.

Let’s get started.

The key takeaways from Microsoft’s ‘Digital Defense Report 2023’

Good cyber hygiene is still the best defence against attacks

The report reveals that over 99% of successful cyberattacks could be prevented by following basic cyber hygiene practices.

Measures like enabling multi-factor authentication (MFA), applying zero trust principles, keeping systems patched and up-to-date, using endpoint detection and response solutions, and protecting data form a robust first line of defence for organisations of any size.

However, human error remains a primary enabler of cyberattacks.

Despite increasingly widespread security awareness training, phishing click rates have remained relatively stable.

This is largely down to the methods of training deployed by organisations. For example, the report found that video-based training only reduces phishing susceptibility by around 3% at best. More personalised, tailored training focused on actual behavioural change, like that offered by Bob’s Business, is required.

Sophisticated phishing attacks are surging

The report warns that adversary-in-the-middle (AiTM) phishing campaigns are surging dramatically.
These attacks involve threat actors using reverse proxy servers to intercept and steal login credentials and session cookies, bypassing traditional protections.

Attackers are also refining social engineering by exploiting trusted third-party communications alongside sending specially crafted phishing messages based on reconnaissance of individual targets.

Ransomware is still a top threat

Ransomware continues to plague organisations, with human-operated ransomware attacks doubling over the past year.

These intrusions often exploit unpatched systems and unmanaged devices. The report observes attackers increasingly using remote monitoring tools to conceal activity and make attribution more difficult.

Business email compromise (BEC) attacks have also skyrocketed, reaching 156,000 daily attempts globally. Threat actors hijack communication threads and leverage cloud infrastructure to conduct more sophisticated invoice and payment fraud.

Nation-states prioritise cyber espionage

The report highlights a shift amongst nation-state groups away from high-volume destructive attacks towards stealthy cyber espionage campaigns.

Key targets include critical infrastructure organisations and policymakers, alongside governments and governmental bodies.

State-sponsored groups are exploiting vulnerabilities faster, enhancing cloud operations, and increasingly using custom malware and “living off the land” techniques to hide activity.

How you can build organisational resilience

Facing this complex threat landscape, the report emphasises the importance of cyber awareness training and building organisational resilience through measures like:

• Prioritising cyber hygiene and zero trust principles
• Providing personalised, skills-focused security training
• Leveraging emerging technologies like AI to analyse threats and automate response
• Implementing robust identity management and phishing-resistant MFA
• Ensuring devices and systems are kept fully patched and up-to-date

In short, Microsoft asserts that organisations that take a strategic, resilience-focused approach to cybersecurity are best positioned to protect themselves against both commoditised attacks and sophisticated, targeted threats.

At Bob’s Business, we’ve helped millions of employees to take responsibility for their organisations’ cybersecurity through effective, engaging and entertaining training.

With over 70 interactive and gamified courses, we give your team the knowledge they need to spot and stop attacks, alongside how to build good cyber hygiene.

Ready to learn more? Discover our range of solutions or chat with a member of our team.

At Bob’s Business, we’re always striving to deliver outstanding training experiences to our customers. It’s been our goal since we were founded in 2007, and it’s as accurate in 2023 as it was all those years ago.

Now, in what marks the sounding of the starting gun for our next phase of business evolution, we’re delighted to announce that our in-house Learning Management System’s full launch is complete.

That’s right – CyberLearn is live for all.

Developed in conjunction with Can Studios, CyberLearn is a customised version of their Training Post learning management system, tailored to our unique needs. This offers a host of benefits for organisations, including:

Tailored Learning Experience: With CyberLearn, we introduce a new era of personalised learning experiences. The platform’s versatile architecture allows for bespoke features and functionalities, ensuring that businesses receive training solutions tailored to their unique requirements.

Agile Development: Empowered by CyberLearn, we’re accelerating the pace of feature development and deployment. This agility translates to faster response times to customer needs and rapidly integrating new, value-driven features into the platform.

Scalability and Flexibility: CyberLearn has been architected to seamlessly scale with the evolving needs of businesses. The platform accommodates growth from small enterprises to large corporations while maintaining optimal performance and user experience.

Robust Data Security: By leveraging CyberLearn, we control data security measures completely. This ensures the utmost protection of organisational information, fostering an environment of trust and confidence.

“Our transition to CyberLearn is a testament to our dedication to innovation and customer-centric focus. This milestone reflects our commitment to equipping businesses with a dynamic learning platform that adapts to their needs and helps build positive cultures,” remarked Melanie Oldham, OBE, CEO at Bob’s Business.

“We are thrilled to collaborate with Bob’s Business in this endeavour. The specialised version of our Training Post LMS speaks to the flexibility and robustness of our platform. By joining forces, we are elevating the e-learning experience for Bob’s Business’s clients and showcasing the adaptability and power of Training Post.” commented Paul Hilton, CEO of Can Studios.

Ready to learn more about our Learning Management System? Contact a team member and discover how it can level-up your organisation’s training.

September has left the building, but while the kids are (finally!) back in school, for many businesses, the headaches have only just begun.

We speak, of course, about cybersecurity breaches. In this blog, we’ll look into how even the most security-conscious individuals and organisations can fall victim to cyberattacks – alongside sharing how your company can stay protected against similar threats.

Let’s get started.

September’s biggest data breaches

Topgolf Callaway

American sports equipment manufacturer giant Topgolf Callaway faced a significant data breach last month, putting the sensitive data of over a million customers at risk.

The company promptly emailed customers, explaining that a third party had breached their systems and accessed data, including names, shipping addresses, email addresses, phone numbers, order histories, passwords, and answers to security questions.

Fortunately, payment information remained secure and was not compromised in the breach.

This breach is particularly concerning because it also exposed data from affiliated brands under the Topgolf Callaway umbrella.

All affected customers were required to reset their passwords as a precautionary measure.

The identity of the party responsible for this breach remains unknown. However, the stolen data poses a serious threat, as it can be exploited for identity theft and phishing attacks.

This serves as a reminder of the necessity of a response plan.

By immediately informing those affected and enforcing a password reset, you can lessen the impact of an incident and heighten everyone’s awareness against potential follow-up attacks, such as a phishing email.

Digital ID and The Greater Manchester Police

Thousands of Greater Manchester police officers and staff have had their personal details compromised. This attack is linked to a third-party supplier, Digital ID, responsible for identity cards and lanyards for UK organisations.

The breach involved the theft of officers’ warrant card information, including names, ranks, photos, and serial numbers, through a ransomware attack.

While financial data remains secure, there are concerns regarding the safety of undercover officers and ongoing investigations.

The National Crime Agency (NCA) is actively investigating the Digital ID breach. Greater Manchester Police is working closely with the Information Commissioner’s Office (ICO), which will conduct its own enquiry.

This incident emphasises the risks of outsourcing sensitive data to third parties and highlights the pressing need for ongoing vigilance, especially in law enforcement and public safety organisations.

Pizza Hut Australia

Pizza Hut Australia also fell victim to a cyber-attack in September, exposing customer information and order details.

The breach came to light in early September, prompting immediate action from the company.

Phil Reed, the CEO of Pizza Hut Australia, informed customers via email about the incident. He stated that an ‘unauthorised third party’ had accessed some of the company’s data.

In response, Pizza Hut took swift action to secure its systems, engaged forensic and cybersecurity experts, and initiated an investigation to determine the extent of the breach.

The compromised data includes customer details and online order information, such as names, delivery addresses, email addresses, and contact numbers.

For registered accounts, encrypted credit card numbers and passwords were also accessed.

Approximately 193,000 customers were impacted and received guidance on avoiding potential future scams.

This incident highlights the importance of working with cybersecurity experts to minimise the impact of data breaches.

By collaborating with cybersecurity professionals, organisations can improve their overall security measures and decrease the likelihood of such incidents occurring in the first place.

What your organisation can learn from September’s data breaches

September’s data breaches stress a crucial lesson: cyber threats affect all.

Here are valuable lessons your organisation can take from these incidents to improve your cybersecurity systems.

1. No one is exempt: Cyber threats spare no one. Regardless of the size or industry of your organisation, it’s important to remain alert to attacks. Regular assessments can help identify vulnerabilities and weaknesses before attackers do.
2. Effective response planning: Developing and regularly updating an incident response plan is crucial. It enables swift and effective action during a breach to mitigate its impact.
3. Third-party risk management: If your organisation relies on third-party suppliers like Digital ID, ensure they adhere to robust cybersecurity standards. Protecting your data is a shared responsibility.
4. Education and awareness is key: Educate your employees on essential cybersecurity practices, including phishing awareness, password security, and defence against social engineering tactics.
5. Invest in training: Invest in cybersecurity training for your employees. A well-informed employee is a critical defence against cyber threats.

How can Bob’s Business help you avoid cyber breaches

At Bob’s Business, we offer affordable awareness training solutions designed to give employees the knowledge they need to protect their data and their organisation.

As part of our dedication to supporting organisations in strengthening their cybersecurity, we’ve created a free Cybersecurity Awareness Month Pack for your organisation.

This resource pack is designed to help you improve your security and reduce the risk of cyberattacks. Click here to get your free pack.

October is Cybersecurity Awareness Month, and this year is particularly special as we mark the 20th anniversary.

Since 2003, the National Cyber Security Alliance has teamed up with the government and private industries to increase cybersecurity awareness in a bid to help users prevent cyber attacks.

This year’s theme is “Secure Our World”, as it aims to promote cybersecurity tips and best practices that are not restricted to October but can be followed throughout the year.

In this blog, we’ll take a closer look at some of the significant data breaches from the past year, and review the NCSA’s recommended best practices for cybersecurity going forward.

Let’s get into it!

What can we learn from the last 12 months of data breaches?

Northern Ireland Police (PSNI)

In August, a monumental data breach occurred when sensitive information, of nearly 10,000 PSNI staff, was exposed online for three hours.

This breach highlighted the importance for ongoing employee training and awareness initiatives, especially in large organisations where attacks can have a long tail and substantial impact.

MOVEit

June 2023 witnessed a widespread data breach affecting over 100 organisations. The Clop ransomware gang constructed the breach.

This incident has reminded us of how important it is to implement strong cybersecurity measures. This includes proactive security measures, keeping your security up to date, and having an incident response and reporting plan to respond to incidents like this.

NHS

During the year, thousands of NHS patients’ data leaked due to a phishing attack.

The attacker accessed an employee’s email account containing confidential patient information, highlighting the risks of phishing.

This stressed the importance of thorough employee training and regular security policy reviews.

Pepsi:

In February, Pepsi experienced a data breach from a malware attack on its payroll systems.

This breach exposed employee data, including names and social security numbers, stressing the need for continuous software monitoring and updates.

These 2023 data breaches provide a reminder of the significance of cybersecurity awareness and the best practices to follow to protect sensitive information.

Four key practices for year-round cybersecurity

Create strong passwords and use a password manager

We have all encountered a friend or colleague with a password that ends in the infamous “123.”

These kinds of passwords, while easy to remember, are also the first ones potential hackers might guess.

It’s no secret that they provide little protection.

Three tips to strengthen your password security:

1. Use three random words: Picking three unconnected, random and memorable worlds will ensure your password is easy to recall but hard to crack.
2. Mix in numbers and symbols: By incorporating a combination of numbers and symbols, you significantly increase the complexity of your password.
3. Never use the same password twice: It’s a golden rule of password security – never reuse passwords across different accounts.

However, remembering unique and complex passwords for every service can be tricky, which is why using a secure password manager is recommended.

A password manager can safely store all your passwords with the only requirement of remembering one password.

Turn on Multi-Factor Authentication

Multi-Factor authentication (MFA) is like an extra lock for your digital doors, available to all and strongly recommended. If someone somehow guesses your password, MFA acts as a second line of defence.

Even with your password, they can’t access your information without your active involvement. Users should set up MFA in a way that requires a secondary code sent to another device when a password is entered.

This extra step helps to verify your identity.

Recognise and report phishing

Phishing attacks are a growing problem and have evolved significantly over the last 20 years, becoming increasingly sophisticated.

This Cyber Awareness Month aims to educate users on how to spot and report phishing attacks before any consequences occur.

Telltale signs of phishing:

• Urgent or alarming language
• Requests for personal and financial information
• Poorly written or misspelt messages
• Incorrect email addresses, domain names, or links (e.g., “facbook.com”)

Reporting protocols:

1. If you suspect phishing, report it to protect yourself and others.
2. When in doubt, forward the message to your security team.
3. Don’t reply, click on attachments, or follow any links, including “unsubscribe” links. .

By following these simple steps, you can play a crucial role in staying safe from phishing attempts and keeping your information secure.

Update your software

Although that “new update available – click now” button might sometimes seem inconvenient, skipping these updates can leave you open to attacks.

Updates fix problems and patch security holes, preventing hackers easy access.

• Check for notifications: Keep an eye on notifications from your devices and applications, and manually check for updates in web browsers and antivirus software. Install Updates
• Act promptly: When software updates pop up, especially the important ones, don’t delay. Install them right away.
• Turn on automatic updates: Protect your data further by turning on automatic updates. Your devices will handle updates as soon as they’re available.

How can Bob’s Business help you this cybersecurity month and beyond?

At Bob’s Business, we know that raising employee awareness is a year-round process!

That’s why we offer uniquely engaging training courses to enhance your security and truly effective phishing simulations for organisations of all sizes.

In addition, this Cybersecurity Awareness Month, we have created a free Cybersecurity Awareness Month Pack, especially for your organisation.

This pack will provide you with the resources to enhance your security, including checklists, email templates, and password guides! Interact with the bot below 👇

It’s Cybersecurity Awareness Month, and we’re thrilled to announce the release of our Free Cybersecurity Awareness Month Pack! 🎉

This pack will equip you and your team with resources to enhance your cybersecurity awareness throughout October and beyond. Here’s what you’ll find in the pack:

• Cybersecurity Awareness Quick Wins Checklist: A handy guide to quickly bolster your cybersecurity defences with actionable tips and best practices.
• Cybersecurity Awareness Month Desktop Wallpaper: Keep the importance of cybersecurity at the forefront of your mind with a stylish desktop wallpaper.
• Email Footer Promoting Good Cyber Health: Easily add an email footer to your communications, spreading awareness about cybersecurity best practices.
• Reusable Blog on the Importance of Reporting: Give your team a heightened understanding of the importance of reporting with a blog to use on your website or via email.
• Four Email Templates for Your Team: Effortlessly communicate the importance of cybersecurity to your team with our pre-designed email templates, discussing common social engineering techniques.
• Guides on Passwords, Onboarding, Phishing, and Remarkable Realities: Dive deep into crucial aspects of cybersecurity with our comprehensive yet approachable guides.

Ready to get started? Interact with the bot below to gain instant access now! 👇

The new school year is about to kick off, and with it, a buzz of excitement among students and staff for new beginnings and opportunities.

However, this period also brings an elevated risk of cyber threats.

According to UK government statistics, the education sector ranks as the country’s second most targeted sector for cybercrime.

In this blog, we will explore the importance of cybersecurity in education and provide insights to assist educational institutions in practising secure cybersecurity measures – especially during this heightened period of cyber threats.

What cyber risks will students encounter?

Phishing

New email addresses and unfamiliar sources:

Phishing emails pose a more significant concern as the school year begins.

Here’s why: at the start of the year, there is an influx of new students and staff, resulting in numerous new names and email addresses being added to the system.

This can make it challenging to distinguish trusted sources from unfamiliar ones.

Communication patterns and onboarding:

Many new users may not yet be familiar with the typical communication patterns within the educational institution.

This lack of familiarity can create challenges in recognising safe emails from potentially malicious ones. Cyber attackers take advantage of this by sending phishing emails, such as “Click here to set up your new account,”.

Attackers assume that amid all these unfamiliar emails, users will be less suspicious and believe it to be part of the onboarding process.

Concerning urgency and information overload:

Another significant issue arises from the surge of important messages at the beginning of the school year.

These messages may include crucial information like new deadlines, enrolment details, and administrative announcements.

Phishing emails often create a sense of urgency, claiming immediate action is required to avoid consequences.

Users are more likely to act hastily without scrutinising the email’s authenticity.

System updates

During the summer holiday there is reduced activity, which can lead to a backlog of pending system updates and security measures.

These updates may not be fully implemented until the new academic year begins, creating vulnerabilities that cybercriminals are eager to exploit.

Weak password security

As the new year starts after a prolonged break, many individuals might not have logged into their accounts for an extended period of time.

Consequently, they might struggle to remember their passwords, leading to a surge in password reset requests.

Additionally, some individuals may opt for easily guessable passwords in a hurry, unknowingly compromising security.

Lack of cybersecurity education

The start of the school year introduces new students and staff, many of whom may still need proper cybersecurity education or have forgotten essential security measures during the break.

This knowledge gap can make them vulnerable to phishing attacks, malware, and other online threats.

The risks associated with poor security in education

Data breaches and privacy violations

Phishing attacks, weak password security, and a lack of cybersecurity education can lead to data breaches within educational institutions.

If cybercriminals successfully attack systems, they can gain access to sensitive student and staff data, including personal information, financial records, and academic records.

Such breaches compromise individual privacy and expose the institution to legal liabilities, reputational damage, and financial losses.

Disruption of academic activities

System vulnerabilities resulting from delayed updates can disrupt academic activities. Cyberattacks can lead to a lack of critical systems and resources that support teaching, learning, and administrative functions.

These disruptions can result in a general loss of productivity, negatively impacting the overall educational experience.

A drain on resources

Addressing the aftermath of cyberattacks, including data breaches and system compromises, often requires significant resources.

Compromised institutions must work to recover and restore compromised systems, which can be time-consuming and expensive.

These unexpected costs can strain the budget of educational institutions, diverting funds from other essential educational initiatives.

How to protect your institution

Cybersecurity training and awareness programmes:

Implement regular and mandatory cybersecurity training and awareness programmes for all students and staff members.

These programmes should cover topics such as identifying phishing emails, creating strong and unique passwords, recognising common cyber threats, and understanding the importance of data security.

Through education, institutions empower individuals to play an active role in cybersecurity defence.

Multi-factor authentication (MFA):

Enforce multi-factor authentication (MFA) across all institutional accounts and systems. MFA adds an extra layer of security by requiring users to provide two or more forms of verification before granting access.

This additional security measure helps protect accounts from unauthorised access, even if passwords are compromised. It significantly reduces the risk of unauthorised access.

Regular system updates and patch management:

Establish a robust system for regularly updating and patching all software, applications, and systems within the institution’s network.

Ensure that critical security patches are applied promptly to address known vulnerabilities. This proactive approach reduces the risk of cyberattacks targeting outdated or unpatched software.

Additionally, schedule system updates during periods of reduced activity, such as at the end of the day or periods when the device isn’t in use, to minimise disruptions to academic activities.

How Bob’s Business can help your educational institution

At Bob’s Business, we provide engaging eLearning cybersecurity training that helps to protect educational sector organisations like the University of Northampton and DMAT Schools.

Our training empowers every team member to recognise and effectively respond to cyber threats, protecting your organisation from the 90% of breaches attributed to human error.

Our training modules are conveniently designed in bite-sized portions, ensuring interactivity and easy integration into your busy schedule.

Eager to learn more? Explore our selection of cybersecurity awareness training products by clicking here.

Cyber breaches are relentless and pose ongoing challenges for organisations to protect their data.

The reality is that no organisation, regardless of size or industry, is immune to the potential consequences of a data breach (we hate to be the ones to tell you!).

In this blog, we will focus on learning from real-life examples of businesses that navigated and recovered from cyber breaches.

Examining their experiences gives us insights into practical strategies for enhancing resilience and security.

Let’s get into it!

Activision

In early December 2022, Activision, a prominent video game maker, fell victim to a data breach.

Hackers exploited an employee through SMS phishing, gaining unauthorised access to the company’s internal systems.

An in-depth analysis of the leaked data by ‘Insider Gaming,’ a respected video game publication, revealed that the breach exposed extensive employee details such as full names, email addresses, phone numbers, salaries, and work locations.

Following an investigation, it was determined that no sensitive employee data, game code, or player data was accessed.

Notably, a Slack account owned by an Activision employee provided hackers an entry point, enabling them to deceive other employees into clicking malicious links.

This breach was attributed to human error, as an unwitting employee clicked on malicious links within an SMS phishing text, inadvertently enabling the breach.

Upon discovering the breach, Activision’s dedicated information security team swiftly initiated countermeasures to address the SMS phishing attempt and rectify the situation.

Activision’s rapid response and comprehensive investigation effectively curtailed the breach’s impact.

This incident shows the importance of addressing human error and rapidly securing sensitive information.

It serves as a reminder that continuous cybersecurity training and vigilant practices are essential within organisations to avoid similar breaches.

Cathay Pacific

In October 2018, Cathay Pacific, Hong Kong-headquartered airline, unveiled a security breach that had occurred in 2014 yet had remained completely undetected.

This incident involved unauthorised entry by hackers into their systems, compromising sensitive passenger data, which included personal information like names, contact details, and passport information.

A hacking group had utilised password-stealing malware to breach administrative systems, affecting 9.4 million global passengers.

The breach was attributed to human error, as a lack of robust password security measures allowed hackers to exploit cyber vulnerabilities and gain access to the airline’s systems.

In response to this breach, Cathay Pacific undertook a series of comprehensive measures to enhance their cybersecurity.

These measures included a dedicated focus on data governance, network security protocols, stringent access controls, comprehensive cybersecurity education programs for employees, and an advanced incident response framework.

Cathay Pacific also acknowledged the ongoing need to invest in evolving IT security systems due to the continuously escalating landscape of cyber threats.

As a consequence of this breach, the UK Information Commissioner’s Office (ICO) imposed a fine of £500,000.

This incident prompted the company to reiterate its commitment to collaborating with authorities and emphasise its dedication to protecting personal data.

This case highlights the crucial significance of proactive cybersecurity measures and the persistent drive for continuous enhancements to mitigate evolving cyber threats effectively.

Marriott Hotel & Resorts

In January 2020, Marriott Hotel & Resorts experienced a significant security breach caused by hackers exploiting vulnerabilities in a third-party application used for guest services.

The breach resulted from the compromised credentials of two Marriott employees, granting unauthorised access to 5.2 million guest records.

A human error led to records containing sensitive data such as passport details, contact information, gender, birthdates, loyalty account specifics, and preferences being compromised.

Marriott’s security team promptly intervened after detecting irregular activities and resolved the breach by the end of February 2020.

Subsequently, Marriott Hotels & Resorts faced a fine of £18.4 million.

The hotel chain contacted affected guests through emails, established a dedicated website, and introduced a call centre to assist guests.

These resources included a step-by-step guide to respond to the breach and details about enrolling in a personal information monitoring service for those affected.

A spokesperson from Marriott stated “Marriott remains committed to the privacy and security of its guests’ information and continues to make significant investments in security measures for its systems.” The U.K.’s Information Commissioner’s Office (ICO) subsequently reduced the data breach penalty for Marriott to £14.4 million.

This adjustment underscores Marriott’s commitment to prioritising the security and privacy of guest data going forward.

How you can protect your business from cyber attacks

1. Implement strong password policies:
   Enforce complex passwords and regular updates for all accounts. Consider multi-factor authentication to add an extra layer of security.
2. Regular employee training:
   Educate your employees about the latest cyber threats, phishing scams, and best practices for identifying and reporting suspicious activities.
3. Update software and systems:
   Keep all software, applications, and systems updated with the latest security patches. Outdated software can be vulnerable to known exploits.
4. Network security measures:
   Employ firewalls, intrusion detection systems, and encryption protocols to safeguard your network and data from unauthorised access.
5. Data backups and recovery plans:
   Regularly back up your critical data to secure locations. Develop a robust data recovery plan to ensure business continuity in case of a cyber attack.

By adopting these proactive measures, your organisation can significantly reduce the risk of falling victim to cyber-attacks and protect sensitive information from potential breaches.

How Bob’s Business can help you

At Bob’s Business, we understand human error’s vital role in cyber attacks and the critical importance of protecting your organisation against potential breaches.

Our comprehensive cybersecurity awareness training empowers your employees with the knowledge and skills they need to become the first line of defence against cyber attacks.

Get in touch with us today to learn how Bob’s Business can partner with your organisation to enhance cybersecurity awareness and ensure a safer digital environment for your business.