Black Friday started as an American tradition, but it has become increasingly popular in the UK over recent years. Consumers rush to take advantage of limited time special offers, driving an increase in online transactions. In 2021, Black Friday saw spending in the UK reach £4.85bn. Given this, it’s no wonder that cybercriminals have marked this eCommerce goldmine on their calendars too, taking advantage of the vast amount of financial information exchanged during this period.
Black Friday helps to kick start the Christmas holiday season shopping, but it is also a time for businesses to be on their guard. Hackers have been known to exploit websites and create a fake site that looks identical to the original. Consumers are lured in with cheaper prices and fall victim to credit card theft, causing damage to the reputation of the business.
Cyber criminals successfully stole £2.5 million from shoppers during Black Friday weekend in 2020. Black Friday saw cyber-attacks soar by 275%. The attacks that resulted in the heaviest losses were focused on unprepared organisations.
The Most Common Cyber Attacks
There are a number of preferred methods of cyber-attack methods employed by cybercriminals aiming to exploit the weaknesses of individuals and organisations. The most common attacks that are seen during this period are:
Web Supply Chain Attack
A web supply chain attack is one where criminals insert compromised hardware and/or software into the third-party applications and open-source tools that your business relies on; the SolarWinds attack of 2020 is one of the biggest examples of this approach.
Web Skimming and Magecart
The word ‘Magecart’ is a combination of Magento (the popular eCommerce platform) and shopping cart. It was originally used by a specific group of criminals who successfully attacked Magento shopping carts and achieved considerable notoriety between 2010 and 2020. In fact, they were so effective, the name Magecart is now used for any attack using their technique, which is also known as web skimming or formjacking. This involves injecting malicious code into a website and extracting data from HTML forms. The attacker can then skim payment information from the visitor and send it to a server that they control.
Ransomware
Holding people or property to ransom is one of the oldest crimes, but with so many individuals and businesses now relying on digital services, digital extortion has become a quick road to riches for criminals with little chance of detection. Even after organisations have paid cyber criminals, they were often targeted again as it is known that victims are often so focused on saving their business that they forget to patch the original intrusion vector.
Man-in-the-Middle Attack
For this kind of cyberattack, imagine someone secretly eavesdropping on a phone call, but in this case, they might place themselves between two of your employees using a messaging app, impersonate one and trick them into sharing their password so the attacker can wreak havoc.
Phishing
In the run-up to Black Friday 2021, phishing attacks more than doubled, soaring from 627,560 in September to 1,935,905 in October, so we can expect at least as many attempts during the Black Friday period this year as well.
Phishing exploits the weakest link in any security chain — humans. Attackers use authentic-looking emails that trick people into handing over their bank information or login details to sites like PayPal or eBay.
Attackers will also use this technique to insert malware onto a company’s network if links or attachments in emails are opened in haste. This technique is particularly successful at this time as people are expecting emails from the likes of Amazon and Royal Mail, and because they may use their work emails for personal events.
Cyber Hygiene: How to Prevent Cyber Attacks
While it is true that the people in your organisation will often be the weakest link, there are some simple measures that you can circulate, including:
- Don’t use your work email for personal actions;
- Ensure that your password is strong and not repeated across services;
- If in doubt do not open a link or attachment on an email;
- Use the report function on any email that you are suspicious of;
- Eliminate implicit trust and verify every source.
Cyber Threat Intelligence
The cyber threat landscape is always evolving and expanding with targeted events like Black Friday just the tip of the iceberg. Businesses need stay ahead of the curve and keep themselves informed of the latest techniques and tactics that threat actors are using to exploit their networks. The best way to remain informed and to protect and future proof your business is to utilise a Cyber Threat Intelligence platform.
Cyber Threat Intelligence platforms like Gemserv’s give you access to user friendly intelligence feeds that provide you with actionable intelligence you need when you need it most. This helps inform your overall cyber strategy and gives your business the edge against the cyber criminals who will target you, your brand and your extended supply chain.