2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.

Ransomware attacks in education decreasing

The year closes with some positive news about ransomware in the education sector. Sophos State of Ransomware in Education 2024 found that ransomware attacks on educational institutions decreased in 2024. Attacks on higher-education institutions dropped from 79% reporting attacks in 2023 to 66% in 2024. Lower education saw a similar decrease, from 80% in 2023 to 63% in 2024. However, the attack rates for both are still higher than the global cross-sector average of 59%.

Ransomware affects education quality

Not surprisingly, a recent study also found that students are impacted by ransomware attacks on the education sector. A study from Action1 found that the majority (64%) of education IT workers report that ransomware impacts education quality. Researchers found the reasons for the attacks are multifold, including that 44% devote only 10% of their IT budget to cybersecurity and the majority of schools (78%) do not employ cybersecurity specialists.

In an NPR article, Noelle Ellerson Ng with the School Superintendents Association said that the reason for targeting the education sector is that schools are often low-hanging fruit. Additionally, she points to the fact that school systems, which collect a lot of valuable data from both students and employees, often are the largest employers in a community.

“That makes it very, very ripe,” says Ng. “And then you layer on the fact that [the data] is so sensitive and so longitudinal and so personal, and there’s a huge vulnerability.”

Reducing cyber risks in the education sector

Even with the decline, schools should continue to focus on reducing their vulnerabilities.

Here are some ways schools can reduce ransomware risk:

• Install antivirus and anti-malware software on all devices. Be sure to also include tablets and phones. Make sure that updates and patches are installed on a timely basis.
• Provide training to all employees and students. Teach good cybersecurity practices, including choosing strong passwords and how to avoid being a victim of phishing. Continually send reminders on not clicking on unknown links or downloading suspicious files.
• Install filtering software. By filtering out potentially malicious links and files, you can reduce the chance of students or employees falling victim to a phishing scheme.
• Use multi-factor authentication (MFA). Because ransomware attacks can start with unauthorized access, educational organizations should take extra steps to ensure that every user who logs in is who they claim to be. With MFA, users must use email, text or token in addition to a password, adding an extra layer of security.

Recovery costs have increased

While the decrease in attacks was positive, Sophos’ report found a troubling trend — the recovery costs have more than doubled for ransomware attacks in education. Lower-education organizations reported a mean cost of $3.76 million to recover from a ransomware attack in 2024, compared to $1.59 million. Researchers found the increase even higher in higher education, more than four times higher from 2023 to 2024 ($1.06 million to $4.02 million).

Here are ways to reduce recovery costs:

• Back up your data. In addition to backing up data in real-time, educational institutions should take precautions to secure the backups, such as by using air-gapped backups as well as immutable backups that cannot be erased. Sophos found that costs for lower-education institutions whose backups were compromised were five times higher ($3 million versus $562,500) than those who had a backup to revert to.
• Segment the network. When a ransomware attack happens on a segmented network, cyber criminals can encrypt only the portion of the network that they accessed. By reducing the amount of data breached and the systems impacted, schools can significantly reduce recovery time and costs.
• Create an incident response plan. Often, the recovery is extended due to schools not containing the ransomware quickly enough. Additionally, business disruption also adds to the recovery time. With an incident response plan, employees know exactly what to do when a ransomware attack occurs by including the four fundamentals of a response plan — planning, detection, recovery and post-incident actions.

Propensity for paying ransom has increased

Recovery costs are also increasing due to the changes in the ransom payment patterns and amounts. When an educational organization pays the ransom to gain access to their data, that exponentially increases the recovery costs.

The Sophos Report found that the decision to pay the ransom has increased in both higher and lower education. In 2023, 56% of educational organizations attacked by ransomware paid the ransom, compared with 67% in 2024. The number of higher-education institutions paying the ransom also increased from 47% to 62%.

Additionally, the amount of the ransom has increased, which also adds to the rising recovery costs. The average ransom in lower education was $3.9 million, with 44% of demands of more than $5 million. Higher education demands also increased to $4.4 million. Ransoms in critical infrastructure sectors, such as education, tend to be higher due to the urgency of restoring operations as well as the sensitive nature of the data. Additionally, cyber criminals increasingly use double extortion, demanding a ransom to unencrypt the data and then a second ransom to not make the data public, which increases recovery costs.

The future of ransomware attacks in education

While the decrease in attacks is positive, educational organizations must pay attention to the rising recovery costs. Because every dollar spent in education towards recovering from an attack means money is not available for learning, the costs of ransomware recovery are even more impactful than other sectors. By proactively taking steps to both reduce risks and reduce recovery costs, educational organizations can keep their focus on what matters most — educating students.

The post Reducing ransomware recovery costs in education appeared first on Security Intelligence.

As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.

Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during the COVID-19 pandemic to avoid attacking healthcare providers has been abandoned. It’s clear that hospitals are now fair game.

Ransomware attacks on the healthcare sector cause real harm to patients, impacting survival rates and threatening other critical services. And ransomware targeting other critical infrastructure carries serious implications for public health and safety.

Ransomware in life-and-death situations

Hospitals depend heavily on digital systems for managing patient care. When a ransomware attack strikes, these systems go offline, with often tragic results. Research highlights the risks: There’s been a 300% increase in ransomware attacks on healthcare since 2015. This led to a spike in emergency cases, including strokes and cardiac arrests, at hospitals overwhelmed by patients diverted from facilities hit by cyberattacks.

A study by the University of California San Diego showed that ransomware attacks on hospitals cause a spillover effect. This means neighboring hospitals see a surge in patients, leading to cardiac arrest cases jumping 81%. Survival rates also dropped for those cardiac arrest cases.

One recent example is the ransomware attack on Synnovis, a pathology services provider to the NHS in London. The attack caused problems with blood tests and transfusions, delaying crucial cancer treatments and elective procedures across several hospitals. This disruption illustrates a common trend in healthcare-related ransomware incidents: Delayed testing and procedures can become life-threatening as time-sensitive treatments are postponed or missed altogether.

In another study of two urban emergency departments adjacent to a healthcare organization under attack, researchers noted significant increases in patient volume, longer waiting times and increases in patient “left without being seen” rates. These delays, according to the study, underscore the need for a disaster response approach for such incidents.

In some cases, the tragic consequences of ransomware in healthcare have been documented in legal proceedings. In 2020, a woman sued an Alabama hospital, claiming that a ransomware attack had contributed to the death of her newborn daughter. The hospital’s computer systems were offline during delivery, preventing access to critical monitoring tools and allegedly leading to severe birth complications. While the case has been settled, it raises the question of whether similar events may have occurred without public awareness.

Ransomware impacts beyond healthcare

While the healthcare sector’s vulnerability to ransomware is uniquely tragic, critical infrastructure sectors are also facing increased risks. When Colonial Pipeline, a major fuel distributor, was hit by ransomware in 2021, it led to fuel shortages across the Eastern U.S. Though no direct fatalities were reported, the panic that ensued may have resulted in at least one fatal car accident as people rushed to stockpile fuel.

In critical infrastructure sectors, the potential for loss of life or injury is significant. Attacks on power grids, water supplies and transportation systems could have severe consequences. Researchers warn that a ransomware attack on an energy grid, for example, could disrupt power to hospitals, emergency services and vulnerable populations, putting lives at risk. If the healthcare industry can serve as a lesson, the fallout from critical infrastructure attacks is not a hypothetical but a looming possibility.

How ransomware threats exploit vulnerabilities in healthcare

Healthcare facilities are attractive targets for ransomware for several reasons. First, they hold a wealth of sensitive patient data, including medical histories, personal information and financial details. The cost of downtime in healthcare is especially high. When health centers are crippled by ransomware, people’s lives are at stake, making hospitals more likely to pay a ransom quickly. Healthcare ransomware incidents result in an average payment of $4.4 million, according to recent studies from the second quarter of 2024.

Additionally, healthcare facilities often use complex and outdated infrastructure, relying on an assortment of vendors and legacy systems that can be difficult to secure. A lack of centralized cybersecurity across networks further increases vulnerabilities, allowing ransomware groups to infiltrate systems and cause cascading disruptions.

Evidence of ransomware’s lethal potential

Although establishing a direct causal link between ransomware attacks and fatalities can be complicated, recent data provides compelling insights. One analysis estimates that from 2016 to 2021, between 42 and 67 Medicare patients died as a result of ransomware attacks. And this doesn’t include private insurer data. Research also highlights the broader health impacts, including reduced care quality and delayed treatments. During cyber incidents, hospitals often resort to manual processes that lack the safety checks and efficiency of electronic health records, increasing the risk of error and missed diagnoses.

The problem isn’t limited to fatalities. Ransomware-induced delays can exacerbate health issues, resulting in long-term complications and higher healthcare costs. A delayed diagnosis can mean the difference between life and death for conditions like heart disease, stroke and sepsis. Ransomware attacks may, therefore, lead to excess deaths, even if the connection is indirect.

The need for resilience against ransomware attacks

To mitigate the impact of ransomware on patient care, some hospitals have begun implementing ransomware response protocols, such as Children’s National Hospital’s “Code Dark” procedures. These response protocols are designed to maintain continuity of care when systems are down, including clear instructions for manual record-keeping, communication protocols and patient triage. Yet, these steps can only go so far. True resilience requires proactive measures like employee training, layered security controls and frequent system backups to minimize disruption.

As ransomware attacks grow more sophisticated, many in the cybersecurity industry argue for policy changes to address the threat. One critical need is better data sharing among healthcare facilities, cybersecurity experts and government agencies to track trends and respond quickly. Governments also need to classify healthcare cybersecurity as a matter of national security, allocating resources and support to help facilities improve resilience against ransomware and other cyber threats.

Addressing the growing ransomware threat

The threats to the healthcare sector provide a stark reminder of the broader risks ransomware poses to society. While healthcare providers are uniquely vulnerable, other critical infrastructure sectors are increasingly at risk. As demonstrated by the Colonial Pipeline incident, the ripple effects of ransomware can be felt across entire regions, affecting services as fundamental as fuel, water and transportation.

For cybersecurity professionals, the rise in ransomware attacks on critical services calls for a proactive approach to defense. This includes advocating for stronger industry standards, encouraging the use of robust cybersecurity tools and supporting cross-sector collaboration to prepare for and respond to attacks. The goal is clear: To minimize the risk that ransomware claims lives, either directly or through delayed access to essential services.

The post When ransomware kills: Attacks on healthcare facilities appeared first on Security Intelligence.

Grocery store shoppers at many chains recently ran into an unwelcome surprise: empty shelves and delayed prescriptions. In early November, Ahold Delhaize USA was the victim of a cyberattack that significantly disrupted operations at more than 2,000 stores, including Hannaford, Food Lion and Stop and Shop. Specific details of the nature of the attack have not yet been publicly released.

Because the attack affected many digital systems, some stores were not able to accept credit/debit cards, while others had to shut down online ordering. Additionally, Hannaford’s website was offline for several days. Food supply issues have lasted several weeks in some cases, especially in the New England area, illustrating the impact cyberattacks have on people’s everyday lives.

Cybersecurity in the agrifood industry

The importance of cybersecurity in the food supply chain continues to increase as the agrifood industry becomes increasingly digitized. The increase in smart farming means a cybersecurity attack can even impact growing and harvesting. In addition to the production and distribution processes, a cyberattack can even impact food safety. For example, a cyberattack could interfere with technology that monitors food temperature during production, which can lead to contamination.

Cybersecurity is especially key in this industry because one issue in one segment can quickly compound across the globe. Because of the complex process of bringing food from farm to table, a single vulnerability in one small company can have a major impact on the food supply chain. Additionally, many agrifood companies rely heavily on third-party vendors.

“One challenge with ransomware attacks is that they can cause consequences for suppliers or partners of the victim company, in addition to the direct impact on the victim company itself. Considering the integrated and interconnected nature of the food and agriculture industry, a disruption in one company likely will have a cascading [effect],” according to the Farm to Table Ransomware Report by Food Ag ISAC.

For example, many grocery store chains hire vendors to transport products from warehouses to stores. A cyberattack on the transportation company can shut down critical systems, meaning that food does not arrive as scheduled, which leads to empty shelves.

“Attacks targeting suppliers, distributors or logistics providers can lead to delays in product delivery, shortages or the introduction of counterfeit products. Disruptions in the supply chain can have far-reaching consequences, affecting not only the profitability of companies but also impacting food availability and increasing prices for consumers,” reports Food Safety magazine.

According to Forbes, FBI Special Agent Gene Kowel, speaking at the August FBI Agriculture Threats Symposium in Nebraska, said: “The cyber risk and national security threat to farms, ranches and food processing facilities is growing exponentially. The threats are evolving, becoming more complex and severe.” He also stated that the four key threats facing the agriculture sector are ransomware attacks, foreign malware, data and intellectual property theft and bioterrorism impacting food production and the water supply. Additionally, he warned that foreign entities are actively attempting to destabilize the U.S. agriculture industry.

Recent agrifood cyberattacks

While grocery stores have dominated the headlines lately regarding agrifood cyberattacks, other companies faced cybersecurity attacks in recent years.

In October 2021, Schreiber Foods, a milk processing company, was the victim of a ransomware attack. According to ZDNET, the attack disrupted the entire milk supply due to a change in the digital processes for milk processing. Wisconsin State Farmer reported that milk deliveries resumed five days after the attack. Additionally, milk transporters were unable to access the building and the company faced a $2.5 million ransomware demand.

The highly publicized attack on JBS, the world’s largest meat-packing company, also happened in 2021. Business was disrupted at 47 locations in Australia and nine locations in the U.S. for five days after Russian hacker group Revil encrypted the organization’s systems. JBS reportedly paid $11 million in ransomware following the attack. The attack also led to some meat shortages as well as temporarily higher meat prices.

Farm and Food Cybersecurity Act

To strengthen cybersecurity in the agrifood industry, the Farm and Food Cybersecurity Act is currently in committee in both the U.S. House of Representatives and the U.S. Senate. A key component of the act is that the secretary of agriculture will conduct a study every two years on cybersecurity threats and vulnerabilities within the agriculture and food sectors.

Additionally, the secretary of agriculture will work with other agencies to conduct an annual cross-sector crisis simulation exercise for food-related cyber emergencies or disruptions.

“Food security is national security, so it’s critical that American agriculture is protected from cyber threats,” says Rep. Elissa Slotkin, D-Mich. “No longer just some tech issue, cyberattacks have the potential to upend folks’ daily lives and threaten our food supply — as we saw a couple of years ago when the meat-packing company JBS was taken offline by a ransomware attack. This legislation will require the Department of Agriculture to work closely with our national security agencies to ensure that adversaries like China can’t threaten our ability to feed ourselves by ourselves.”

Reducing the risk of agrifood cyberattacks

Because of the critical nature of their services in relation to the food supply, all companies involved in the agrifood industry should make cybersecurity a high priority. To help improve cybersecurity in the industry, the Cybersecurity and Infrastructure Security Agency (CISA) recently released a Food and Agriculture Cybersecurity Checklist.

Tips from the sheet include:

• Use strong passwords
• Turn on multi-factor authentication
• Recognize and report phishing
• Update software with new versions and patches
• Use cybersecurity tools to mitigate exposure
• Back up your data
• Develop cybersecurity incident response and recovery plans
• Report cybersecurity incidents to www.cisa.gov/report

While the recent empty shelves in grocery stores are a stark reminder of the importance of cybersecurity, the agrifood industry must stay proactive about addressing cybersecurity risks every day of the year.

The post How cyberattacks on grocery stores could threaten food security appeared first on Security Intelligence.

As we near the end of 2024, ransomware remains a dominant and evolving threat against any organization. Cyber criminals are more sophisticated and creative than ever. They integrate new technologies, leverage geopolitical tensions and even use legal regulations to their advantage.

What once seemed like a disruptive but relatively straightforward crime has evolved into a multi-layered, global challenge that continues to threaten businesses and governments alike.

Let’s take a look at the state of ransomware today. We’ll focus on how cyber criminals are changing tactics, relying on AI technology, exploiting legal frameworks and more.

AI supercharges phishing and social engineering

One of the most significant developments in the ransomware landscape has been the use of artificial intelligence (AI) to enhance phishing and social engineering attacks. Historically, phishing emails often contained obvious signs of fraud — misspelled words, poor grammar and generic messaging. However, new generative AI tools can craft highly personalized and professional-looking emails, which has drastically changed the game. This likely explains why phishing attack volumes and success rates have been rising since phishing campaigns are easier to generate and are more convincing than ever.

AI allows threat actors to mine vast amounts of data to craft convincing emails targeting specific individuals or organizations. These emails may contain contextual information that makes them seem legitimate, significantly increasing the likelihood of success. The ability to deliver such precise attacks is why ransomware has been particularly devastating to industries like healthcare, where any disruption can have life-threatening consequences.

Additionally, AI-generated deepfake technology has begun to play a role in social engineering. Cyber criminals can now create audio and video deepfakes of company executives to trick employees into transferring money or revealing sensitive information. This has made detecting fraud much harder, and organizations are finding it increasingly difficult to protect against such attacks.

Weaponizing disclosure rules

Ransomware groups are not just relying on technical means to pressure victims into paying ransoms — they are also manipulating legal regulations to their advantage. One of the most striking developments in 2024 has been the weaponization of disclosure rules, specifically those issued by the U.S. Securities and Exchange Commission (SEC).

A recent high-profile case involved the ransomware group BlackCat/ALPHV filing a formal SEC complaint against a digital lending service provider. After exfiltrating the company’s files, the group allegedly reported to the SEC that the provider failed to comply with regulations that require organizations to disclose any cybersecurity incident within four business days. This added “legal” tactic was designed to pressure victims into paying the ransom to avoid financial penalties or reputational damage.

This disturbing incident shows that ransomware groups will use anything, even government regulations, as leverage. “Threat actors are using the regulations to put more pressure on the victims. This is quite an interesting trend,” said Ifigeneia Lella, a cybersecurity expert at the European Union Agency for Cybersecurity (ENISA). It is a chilling reminder that legal frameworks, while intended to protect the public and promote transparency, can be manipulated by bad actors to further their own malicious agendas.

Living-off-the-land attacks fly under the radar

As per the ENISA Threat Landscape 2024 report, the past year saw increasing use of “living-off-the-land” (LOTL) techniques by cyber criminals. LOTL attacks involve using tools and software that already exist within a victim’s system, making it harder for security teams to detect malicious activity. Instead of relying on external malware that can be flagged by antivirus software, attackers leverage legitimate administrative tools like PowerShell or Windows Management Instrumentation (WMI) to execute their attacks.

For example, PLAY, a multi-extortion ransomware group, often uses off-the-shelf tools like Cobalt Strike, Empire and Mimikatz for discovery and lateral movement within a target’s network. By avoiding the introduction of new, suspicious software, attackers can evade detection for longer periods, often until it’s too late for the victim to respond effectively. This shift towards LOTL techniques represents an ongoing challenge for cybersecurity professionals, as traditional antivirus solutions are becoming less effective against these subtle attacks.

Ransomware, geopolitical tensions and hacktivism

In addition to technological advancements, ransomware is increasingly being used as a weapon of geopolitical influence and hacktivism. Cyber criminals are no longer just motivated by financial gain; some are using malware to further political agendas, destabilize governments or create chaos in certain regions.

The ENISA report emphasized how geopolitical tensions are converging with ransomware attacks. For instance, during the Russia-Ukraine conflict, ransomware groups targeted critical infrastructure in Ukraine and other countries allied with Ukraine. These attacks weren’t necessarily financially motivated but rather politically driven. The aim was to disrupt national operations or cripple key sectors like energy, health care and transportation.

Hacktivist groups are also joining forces with ransomware gangs to push their own ideological goals. For example, attacks on public administration and transportation sectors have increased, often tied to specific political events or global movements. As cyber crime becomes more politicized, organizations and governments must recognize that ransomware is no longer just a financial threat but also a tool of disruption on the global stage. And given the increased geopolitical tensions across the globe, these types of attacks are increasingly common.

Attack rates and most targeted industries

Despite global efforts to curb ransomware, the number of ransomware attacks continues to rise. According to the Ransomware Tracker, the number of victims posted on extortion sites spiked in May 2024 to 450, up from 328 in April, making it one of the most active months over the last few years.

Industries like healthcare, public administration, transportation and finance are among the most targeted. These sectors are particularly vulnerable due to their reliance on digital infrastructure and the severe consequences of operational downtime. For example, the U.S. Department of Health and Human Services reported a 256% increase in hacking-related breaches in healthcare over the past five years, underscoring the sector’s heightened vulnerability.

The rising costs of ransomware

The financial impact of ransomware continues to grow in 2024, with costs extending beyond ransom payments. According to one industry report, the average recovery cost for ransomware victims in state and local governments is $2.73 million, more than double the amount reported in 2023. These costs include not only ransom payments but also expenses related to downtime, lost data, operational disruption and reputational damage.

The ransom demands themselves are also skyrocketing. The report states that the average ransom demand for state and local governments is now $3.3 million, with some demands exceeding $5 million. Globally, industries like healthcare, energy and education are seeing similar trends. Even worse, high ransom demands and significant recovery costs can cripple or even shut down smaller organizations.

A grim landscape, but there’s hope

The ransomware landscape in 2024 is one of increasing complexity. With AI-driven phishing campaigns, living-off-the-land techniques, the exploitation of legal frameworks and the merging of geopolitical tensions, the stakes have never been higher. However, advancements in AI cybersecurity tools and a growing awareness of these evolving tactics provide pathways for improving defenses.

As cyber criminals adapt and innovate, so too must cybersecurity professionals and organizations. Proactive measures like vulnerability management, employing robust backup strategies and investing in incident response capabilities are essential in combating this ever-present threat. Ransomware may continue to evolve, but so too can the tools and strategies used to fight it.

The post The current state of ransomware: Weaponizing disclosure rules and more appeared first on Security Intelligence.

The new year always kicks off with a flood of prediction articles; then, 12 months later, our newsfeed is filled with wrap-up articles. But we are often left to wonder if experts got it right in January about how the year would unfold. As we close out 2024, let’s take a moment to go back and see if the crystal balls were working about how the year would play out in cybersecurity.

Here are five trends that were often predicted for 2024.

1. The use of artificial intelligence in cybersecurity will increase

As the year began, there was no doubt that artificial intelligence (AI) would be a main character in the year’s events — and that was right on the money. Many organizations began to use or continue using AI in their cybersecurity operations in a wide range of ways. For example, Microsoft’s internal response teams use a large language model to manage requests and tickets based on how they were handled previously, saving 20 hours per person each week.

As the world turned its attention over the summer to the Paris Olympics, the team responsible for keeping the Paris Olympics data, apps, systems and even physical buildings protected turned to AI. While 140 cyberattacks were linked to the Olympics, the teams’ efforts resulted in no disruption of the competitions.

Throughout the entire life cycle of the games, from before the opening ceremony to after the torch left Paris, cybersecurity teams used AI to secure critical information systems, protect sensitive data and raise awareness within the games’ ecosystem. Additionally, algorithmic video surveillance based in AI scanned video to detect abandoned bags, the presence of weapons, unusual crowd movements and fires.

2. Organizations will see more AI-based threats and attacks

Unfortunately, experts were right about cyber criminals also turning to AI technology to more effectively conduct attacks. Threat actors are using AI in a wide range of ways for data breaches and cyberattacks, including improved reconnaissance, better target profiling and lowering expertise required for conducting an attack. Because AI can automate many processes required for an attack, such as vulnerability scanning, exploitation and data exfiltration processes, more cyber criminals now have the skills for even more damaging attacks.

“Since the release of gen AI, attackers are increasingly employing tools along with large language models to carry out large-scale social engineering attacks, and Gartner predicts that by 2027, 17% of total cyberattacks/data leaks will involve generative AI,” wrote Gartner in an August 2024 press release.

IBM distinguished engineer Jeff Crume has no doubt that the trend of cyber criminals using AI for attacks will continue in 2025. He says that cyber professionals do a better job of authentication because attackers are finding it easier to log in than to hack in. While looking for bad grammar and spelling errors now works to spot phishing attacks, he expects that this will no longer work as AI-based phishing attacks hit mass distribution.

3. An increase in deepfakes and deceptions

While experts correctly predicted that deepfakes would become more of a threat in 2024, it’s likely no one expected the scale of arguably the most shocking deepfake story of the year. At the beginning of 2024, attackers created a deepfake video call that led to an employee giving the cyber criminals $25 million, which showed the power and damage that deepfakes can cause. But the World Economic Forum expects that the trend will only increase, even declaring that over the next two years, AI-fueled disinformation will be the number one threat in the world.

Throughout the year, other deepfake incidents made headlines. Quantum AI, an AI company, was suspected by the Securities and Exchange Commission of using AI to generate deepfakes on social media to deceive the public that Elon Musk developed the company’s technology. Even the well-received Paris Olympics were not immune to deepfakes, with Russian Group Storm-1679 suspected of creating AI content to discredit the International Olympic Committee. As the year closed out, German citizens saw an increase in AI-based propaganda regarding the upcoming German elections in 2025, including text, images and video.

4. A growing impact of quantum computing on cybersecurity

Ray Harishankar, IBM Fellow, IBM Quantum Safe, predicted that in 2024, “harvest now, decrypt later” attacks would become more common. As the year moved forward, quantum computing became an increasingly top concern, especially the harvest-now attacks. In July, the Office of Management and Budget released the Report on Post-Quantum Cryptography, which urged organizations to prepare their systems and processes for advancements in quantum computing.

During the fall of 2024, the predictions of the quantum’s impact became even more urgent, as symmetric cryptography would be unsafe by 2029, with even asymmetric cryptography fully breakable by quantum technology by 2034.

“That does not mean, however, that the risks are five years away. The prospect of harvest-now, decrypt-later attacks is already a concern, making the post-quantum cryptography transition an urgent priority,” wrote Gartner.

 5. Recession of ransomware attacks

John Dwyer, former Head of Research at IBM X-Force, predicted we might face a ransomware recession as more companies pledged not to pay the ransom. While we wish we could declare this came true, the jury is still out, and likely, we won’t know for sure until all the data is collected from 2024.

However, Wired declared in the summer of 2024 that “ransomware showed no signs of slowing down in 2024 — despite increasing police crackdowns.” In December, Heather Wishart-Smith wrote in her Forbes article The Persistent Ransomware Threat: 2024 Trends and High-Profile Attacks about the increasing dual extortion technique of cyber criminals as an increasing trend in 2024.

All in all, the experts were largely on target with their 2024 predictions. And in the next few weeks, we will start the prediction game all over again as we wonder what’s in the cards for cybersecurity in 2025.

The post 2024 trends: Were they accurate? appeared first on Security Intelligence.