Governments, corporations increasingly concerned about hacker attacks

These cases are examples of crimes that have increasingly concerned governments and large corporations: attacks on critical systems, such as payment platforms, port and airport navigation systems, and the operation of power plants, including nuclear power plants. It’s no surprise that cybersecurity was the main topic of discussion at this year’s Futurecom in São Paulo. Hacks into critical systems have disruptive potential and can have a similar effect to a terrorist attack, except that the attackers can be miles away and easily conceal their identities. This is what happened last September, when a cyberattack hit several European airports, including Heathrow (UK), Brussels (Belgium), and Dublin (Ireland), among others.

The objective, in attacks on both government and corporate targets, is economic, whether by stealing large sums, demanding ransoms to “return” tech systems’ control to their original owners, or stealing citizens’ data for use in other crimes. “There’s [a lack of] punishment and difficulty in tracking and identifying these hackers. Furthermore, payments [to criminals] are made with cryptocurrencies, which can be untraceable,” says Márcio Kanamaru, leading partner for technology, media, and telecommunications (TMT) at KPMG.

The losses reach hundreds of billions of dollars. According to a study by Cybersecurity Ventures, published last March, ransomware attacks are expected to cause losses of $57 billion this year, and the figure is expected to reach $276 billion per year by 2031. According to an IBM global survey on the cost of data breaches conducted with approximately 600 companies, these attacks caused, on average, losses of $4.4 million for companies. Furthermore, some industries face more problems than others. The average loss among healthcare companies, for example, is $7.42 million per system breach. Criminals target databases containing patient information, which are then used to defraud insurance companies and impersonate people, among other crimes.

Losses vary from the ransom paid to criminals to the time it takes companies to fully restore their systems after a breach. The IBM survey indicates that 76% of organizations took more than 100 days to recover from an attack, while 26% took more than 150 days to resume normal operations—only 2% of the companies surveyed said they took less than 50 days to restore their systems. “This calculation compares similar situations. We try to understand how long the company’s system was down. But it’s still a very subjective metric,” explains Eliane Rodrigues, director of information security at VTEX.

Another problem is underreporting, as many crimes are not reported to authorities to avoid damaging the organization’s reputation. “Generally, companies don’t want their names involved; they often don’t even file a police report to avoid exposure,” says Paulo Baldin, director of cybersecurity at CLA Brasil. Underreporting is even more common in companies targeted by organized crime. “When a police operation and a company’s name appear in connection with a criminal group, it causes significant reputational damage,” emphasizes Paula Leite, director of business intelligence at security consultancy Control Risks.

But cybercrimes can take on even greater dimensions, especially when attacks are carried out between nations. “One of the first measures Russia took against Ukraine was to attempt to take down the enemy country’s digital infrastructure,” highlights Carlos Barroso, IP head for Latin America at Nokia. “These invasions are intended to demoralize governments and destabilize regions,” Mr. Barroso believes. “On a broader geopolitical level, it is possible to compromise energy and water infrastructure and cause very serious accidents for the population,” adds Arthur Capella, general director of Tenable Brazil.

These attacks are also becoming more frequent. In July, the Singapore Ministry of Defense said its critical systems were being targeted by hackers, allegedly Chinese, who were attempting to spy on essential sectors such as energy, telecommunications, and the public healthcare system. In October 2024, the servers of American Water, the largest public sanitation utility in the United States, were hacked, putting the water supply to 14 million Americans at risk. The company managed to shut down its systems before a major loss occurred, but the customer service portal, as well as the billing system, was down for a few days, creating problems for consumers.

The biggest challenge in the coming years will be building mechanisms to mitigate these risks, as the cybersecurity industry faces challenges such as a lack of skilled labor and the need for more investment, says Mr. Kanamaru of KPMG. “As the trend is for infrastructure to become increasingly digital, it’s important to consider a long-term government policy for cybersecurity. We will have to continually invest and have budgetary provisions to ensure these critical systems are always protected.”

*By Pedro Marques — São Paulo

Source: Valor International

https://valorinternational.globo.com/