← Cybersecurity Today
Cybersecurity Today
Record-Breaking Cybercrime Losses and Data Breaches in 2024
00:09:45
In this episode of Cybersecurity Today, host David Shipley discusses the FBI's report on cybercrime losses in 2024, which reached a record $16.6 billion, marking a 33% increase from the previous year. The report highlights major types of cyber...
Loading summary
Transcript1 lines
- [00:00]
David Shipley
The FBI says cybercriminals stole a record $16.6 billion in 2024. Blue Shield of California leaks health data of 4.7 million members to Google. A new report says 86% of global firms hit by ransomware pay up despite having backups. And Verizon's 2025 data breach investigation report says ransomware is now a factor in nearly half of all cyber incidents. This is Cybersecurity Today and I'm your host David Shipley. The FBI is reporting that losses by American individuals and businesses increased a staggering 33% in 2024 from 2023 and hit a record $16.6 billion. The FBI's Internet Crime Coordination center, or IC3, says it has received 859,000 complaints of suspected Internet crime. Just over a quarter million of those reports involved actual financial losses. The top three reported cybercrimes by number of complaints from victims in 2024 were phishing, spoofing, extortion and personal data breaches. Victims of investment fraud, specifically those involving cryptocurrency, reported the most losses, totaling over $6.5 billion. According to the 2024 report. The most complaints were received from California, Texas and Florida. As a group, people over the age of 60 suffered the most from cybercrime, with losses of nearly $5 billion, and they submitted the greatest number of complaints. Cyber enabled fraud accounted for nearly 83% of all losses reported to the IC3 in 2024, with 330,981 complaints and a staggering 13.7 billion. Of the 16.6 billion in losses coming from cyber enabled fraud. Investment fraud led in total dollars lost at 6.57 billion, followed by business email compromise or Beck scams at 2.77 billion and tech support fraud at 1.46 billion. Sextortion and other forms of extortion experienced a notable surge in 2024, resulting in 54,936 complaints and $33.5 million in losses, a 59% increase in complaints from the previous year. Other significant scams included emergency scams targeting seniors, such as grandparent scams, which resulted in 357 complaints and $2.7 million in losses gold courier scams, which involve 525 complaints and $219 million in losses and toll highway scams, including text message scams about unpaid road tolls that accounted for 59,271 complaints and over $129,624 in losses. Last but certainly not least, in 2024, more than 4,800 organizations that are deemed critical infrastructure in the United States reported being affected by cyber threats. The most common problems reported by these organizations were data breaches and ransomware attacks. The losses in this report are likely, though only a fraction of the total actual financial losses by Americans to cybercriminals, as typically only 1 in 10 victims report crimes to police on average, meaning the total losses to cybercriminals from victims in the United States in 2024 could be as high as $166 billion. Blue Shield of California disclosed it suffered a data breach after exposing protected health information of 4.7 million members to Google's analytics and advertising platforms. The nonprofit health plan, which serves nearly 6 million members across California, published a data breach notification on its website stating that member data was exposed between April 2021 and January 2024. The nonprofit health plan, which serves nearly 6 million members across California, published a data breach notification on its website stating that member data was exposed between April 2021 and January 2024. According to a breach disclosure notice on the U.S. health and Human Services Department website, the exposure was caused by a misconfiguration of Google Analytics on certain Blue Shield websites. This resulted in the sensitive data potentially being shared with Google advertising platforms and other advertisers. The types of data exposed as a result of the misconfiguration include insurance plan names, types and group numbers of plans, city and zip codes, gender, family size Blue Shield assigned identifiers from members, online accounts, medical claims service date and service provider, patient name and patient financial responsibility and the quote find a doctor search criteria and results including location, plan name and type, provider name and type. Blue Shield noted that other personal information such as Social Security numbers, driver's license numbers, banking and credit card information were not exposed as a result of the incident. Now, interestingly enough, Google is quite clear in its Google Analytics technology platform that that technology is not compliant with the United States Health Insur Portability and Accountability act or HIPAA and states very clearly the technology must not be used on websites or pages that involve the collection or disclosure of personal health information. But this has been a long standing problem. In 2023, a cybersecurity firm raised the alarm that many US healthcare websites were violating HIPAA by using Google Analytics or similar tracking technologies from Meta, Adobe or others. 22 different US hospitals were caught up in class action lawsuits in 2022 and 2023 over the use of these kinds of trackers. Bleeping Computer noted that this is the second major cyber incident in the last year for Blue Shield of California. Last year, nearly 1 million health plan members had their data stolen by the black suit ransomware actors who breached the organization's software solutions provider Connecture, formerly Young Consulting. Speaking of ransomware, there's more bad news piling up this week. CSO Online is reporting that enterprises continue to pay ransom demands due to compromised recovery systems and growing data extortion threats. Despite seemingly more cybersecurity tools today than stars in the sky, organizations around the world are still surrendering to ransomware attackers at a startling rate. According to new research from Rubrik Zero Labs, 86% of organizations globally admitted to paying ransom demands following a cyber attack in the past year. And it seems recovery is still where most organizations plans are failing. This finding comes from Rubrik's 2025 report, quote, the State of Data Security a Distributed Crisis, end quote, which surveyed more than 1,600 IT and security leaders across 10 countries, including the United States, the United Kingdom, France, Germany, India and Singapore. In the study, 74% of organizations said their backup and recovery infrastructure was partially compromised, while 35% reported a complete compromise. This targeting of recovery systems has become a hallmark of modern ransomware campaigns. Also on the ransomware roundup, the Verizon data breach report dropped Wednesday with the not so fun fact that almost half of all incidents they reviewed in 2024 involved ransomware. Given the previous story on the high number of enterprises paying, it seems that crime, particularly ransomware crime, continues to pay online. Now my favorite section of the Verizon breach report is always on phishing and phishing simulation training and the data there this year shows that there is a compounding improvement when it comes to training in reporting of suspicious emails by users. I'll save the rest of my thoughts for the month end review when Jim's back, but I have more thoughts on why phishing simulation training doesn't get Click rates to 0, which is a question the Verizon data breach report talks about. And I'll have some new fresh data from Boseron's work on why people click. I'll be on the road this week in San Francisco attending BSides in RSA. If you'd like to meet, drop me a note@david.shipleyceronsecurity.com and I'd love to chat about cybersecurity or what you might like to see on the podcast. I've been your host David Shipley, sitting in for Jim Love who will be back on Wednesday. Thanks for listening.