Case Study of Cyber Security
Name: Anuj Gajanan Ghuge.
Rollno : TB1179.
Class : TYBBA-CA.
Div : B1.
Sub : Cyber Security.
1. WannaCry Ransomware Attack (2017) :
Scenario:
• Global ransomware outbreak in May 2017.
• Targeted multiple industries, including healthcare, logistics, and government institutions.
• Exploited a vulnerability in Windows systems (EternalBlue).
Attack:
• Ransomware encrypted files on infected systems.
• Users were demanded to pay a ransom in Bitcoin to decrypt files.
• Spread rapidly across unpatched systems globally.
• WannaCry was a ransomware attack that spread rapidly across the globe, encrypting data
on infected computers and demanding ransom payments in Bitcoin1
Response:
• Immediate patching of systems using Microsoft's MS17-010 patch.
• Collaboration among governments and security companies.
• Response: Organizations worldwide responded by isolating infected systems, applying
patches, and restoring data from backups2.
• Some victims resorted to paying ransom; others restored from backups.
Impact: Affected over 200,000 computers in 150 countries.
• Disrupted operations of organizations like the UK's National Health Service (NHS).
• Estimated financial damage in the billions.
• The attack affected over 200,000 computers in 150 countries, causing significant
financial losses and disrupting services in various sectors, including healthcare and
transportation3.
Lessons Learned:
• Regular system updates and patching are essential.
• Importance of having offline backups of critical data.
• Strengthened incident response planning in organizations.
• Need for global cooperation in cyber defense.
2.Equifax Data Breach (2017) :
Scenario:
• Data breach at Equifax, a major credit reporting agency.
• Occurred in July 2017, exposing sensitive data of 147 million individuals.
• Exploited a vulnerability in Apache Struts software.
Attack:
• Attackers gained access to personal data, including Social Security numbers, addresses,
and birth dates.
• Hackers exploited a vulnerability in Equifax's web application software, gaining access to
personal information of approximately 147 million people17.
• Exploited an unpatched web application vulnerability.
• Breach lasted for several months undetected.
Response:
Launched an internal investigation and engaged cybersecurity firms.
Equifax responded by offering free credit monitoring and identity theft protection services to
affected individuals and enhancing their security measures18
• Lawsuits and regulatory investigations followed.
Impact:
• Significant reputational damage to Equifax.
• Multiple lawsuits and regulatory penalties, costing the company millions.
• Large-scale identity theft and fraud concerns for affected individuals.
Lessons Learned:
• Timely patch management is critical to prevent data breaches.
• Comprehensive monitoring of systems for unusual activity.
• Importance of transparent communication with the public during breaches.
• Strengthened data protection regulations globally.
3.Target Data Breach (2013) :
Scenario:
• Hackers infiltrated Target’s point-of-sale (POS) system in November 2013.
• Attackers gained access through a third-party HVAC vendor.
Attack:
• Stolen login credentials from a third-party vendor were used to access Target’s network.
• Malware was installed on POS systems to steal payment card data.
• Over 40 million credit and debit card accounts compromised.
Response:
• Target informed law enforcement and began notifying customers.
• Offered free credit monitoring to affected individuals.
• Invested heavily in upgrading security and improving system monitoring.
Impact:
• Huge financial losses due to customer settlements, lawsuits, and fines.
• Significant drop in customer trust and brand reputation.
• Triggered broader industry focus on securing thirdparty access.
Lessons Learned:
• Importance of securing third-party vendor access.
• Need for encryption of sensitive data in real-time.
• Constant monitoring for unusual network activity.
• Proactive customer communication to mitigate damage
4. Colonial Pipeline Ransomware Attack (2021) :
Scenario:
• Largest fuel pipeline in the U.S. was hit by ransomware in May 2021.
• Attackers shut down operations, causing fuel shortages across the East Coast.
Attack:
• Ransomware attack executed by DarkSide, a hacker group.
• Attackers gained access to the system through compromised credentials.
• Pipeline operations were halted to prevent further damage.
Response:
• Colonial Pipeline paid a $4.4 million ransom to restore operations.
• FBI later recovered part of the ransom in cryptocurrency.
• Affected regions faced fuel shortages and price spikes.
Impact:
Highlighted vulnerabilities in critical infrastructure systems.
• Increased fuel prices and panic-buying due to temporary shortages.
• Sparked discussions on cyber resilience in essential services.
Lessons Learned:
• Importance of securing critical infrastructure from cyber threats.
• The need for strong multi-factor authentication for remote access.
• Incident response planning must include disaster recovery protocols.
• Raised awareness of the cybersecurity risks in essential services.
5.Yahoo Data Breach (2013-2014) :
Scenario:
• Yahoo suffered two large-scale data breaches between 2013 and 2014.
• Hackers stole personal data of 3 billion user accounts, including passwords, security
questions, and emails.
Attack:
• Attackers exploited vulnerabilities in Yahoo’s security protocols.
• Data from all Yahoo users were compromised, including sensitive PII.
• Breaches went undetected for years and were only disclosed in 2016.
Response:
• Yahoo offered users the ability to reset passwords and security questions.
• Launched internal investigations and improved security measures.
• Faced lawsuits and regulatory scrutiny over delayed disclosure.
Impact:
Massive reputational damage for Yahoo.
• Significant drop in the company’s market value and user trust.
• Major factor in Verizon lowering its acquisition price for Yahoo by $350 million.
Lessons Learned:
• Timely detection and disclosure of data breaches are crucial.
• Use of strong encryption for sensitive data.
• Need for continuous evaluation of security practices.
• Companies must take responsibility for protecting user data.
