Last year, a hacking group calling themselves ‘TheDarkOverlord’ released data from the California investment bank WestPark Capital.
The data featured background checks on five individuals, private stock offering details related to Facebook and other companies; including nondisclosure agreements, internal presentations, reports and contracts. This came after CEO of WestPark, Richard Rappaport, failed to pay the sum that TheDarkOverlord had demanded as ransom.
However, this was only the beginning for TheDarkOverlord; a trailer of what was to come.
Last week, the hacking group posted a link to an illegal downloading site that contains the first 10 episodes of the forthcoming Orange is the New Black season after Netflix refused to cave to the group’s ransom demands.
“It didn’t have to be this way, Netflix,” the group posted in their press release statement. Ironically, the statement in its entirety read like the script of a Netflix drama:
"We figured a pragmatic business such as yourselves would see and understand the benefits of cooperating with a reasonable and merciful entity like ourselves. And to the others: there's still time to save yourselves. Our offer(s) are still on the table - for now.”
The others they reference include ABC, National Geographic, Fox and IFC. While the group has yet to release episodes from these networks, a colossal data-dump featuring the medical records of over 180,000 patients was released on May 4th, following their cyber-attack of 3 major healthcare providers last year.
Why release medical records? Well, according to TheDarkOverlord’s Twitter, the clinic “didn’t do anything wrong except annoy us.”
That’s quite alarming. I mean, the barista who put sugar in my cappuccino when I said “no thank you” did nothing wrong other than mildly annoy me, but I don’t feel the need to track him down and leak his private conversations with the world. (Don’t worry Mark, your Tinder is safe. For now.)
Just who is TheDarkOverlord?
Personally, I’ve never quite understood the concept of naming yourself “dark” or “evil.” Either you know what you’re doing is bad and therefore, should probably stop, or you’re self-conscious about your abilities as a leader so you’re using a scary title to make yourself feel important. I’m looking at you, Voldemort.
A quick Google search should explain all you need to know about TheDarkOverlord:
“The Dark Overlord of the Universe is a powerful alien, member of an ancient race of world dominators. Confined in an alternate dimension, the Dark Overlord seeks revenge and waits for the occasion of his dominion to come back.”
Now, although this information actually pertains to the comic book villain featured in Marvel’s Howard the Duck, it seems the hacking group has chosen this name for good reason; after all, they seem to have a lot in common. For one, we’ve already seen the power that this group has through its ransomware attacks on global corporations.
We also know that TheDarkOverlord is confined to the alternate dimension of The Internet; since that’s where these attacks are taking place. But what about revenge? Well, after finding the Press Release statement posted by the TheDarkOverlord last week, it seems they got sick of waiting for their favourite TV show:
“With this information in mind (and the fact that leaving people on cliffhangers isn't fun) we've decided to release Episodes 2-10 of "Orange Is The New Black" Season 5”.
On April 28th, TheDarkOverlord posted the following tweet:
“We've elected ourselves to participate in the grand creation of history itself. Marvellous, isn't it?”
If that doesn’t sound like the words of a powerful alien, confined to an alternate dimension, seeking revenge and waiting for the occasion of their dominion to come back, I don’t know what does. So, for the rest of this blog, I’d like you imagine TheDarkOverlord to look something like this.
(If you feel disturbed by this image, let it serve as a health warning of what you could become if your addiction to Netflix continues.)
Cybercrime Trends of 2017
In our last blog on cybersecurity, we looked back at major cyber attacks of 2016 and the impact they had on society. From the Clinton campaign to the Ukranian electricity outage, 2016 sounded the alarm bells for businesses across the globe. After learning that Facebook and Google were conned out of $100m in a sophisticated phishing scam, it was only natural for panic to ensue: after all, if Google and Facebook can get hacked, how can we protect small businesses?
According to the government’s ‘Cyber Security Breaches Survey 2017’, fraudulent emails are the most common security breach experienced by SMEs. All it takes is one member of staff to open up what they believe to be an innocent email (e.g. “Please update your Gmail password) for your network to be compromised, and these scams are becoming more sophisticated and easier to fall for.
As well as fraudulent emails and the work of TheDarkOverlord, recent cyber-attacks have proven that malicious actors have been focusing their efforts on defeating the 2-Factor Authentication security provision used by a wide range of businesses. Last week, German newspaper Süddeutsche Zeitung reported that customers of O2 Telefonica had their bank accounts drained as a result of cyber-criminals intercepting two-factor banking passcodes. While O2 Telefonica were aware of certain vulnerabilities of the system, they believed the risk to be minimal.
The expansion of the Internet of Things has also increased our “cyber-insecurity”, and the more we develop these devices to facilitate our business and personal lives, the more vulnerable we become to cyber-attacks. Improving your company’s security is now of paramount importance; and the first step towards protecting your data is by assuming your network will be breached.
It sounds a bit paranoid, but creating a security-conscious culture in your business will help staff at every level to understand how everyday behaviour affects the security of their personal affairs and the company.
Reasons to be Fearful
As technology continues to evolve at an exponential rate, businesses must start treating cybersecurity as a top priority. Stronger passwords, cyber-security training for all staff and resilient incident management plans are just three areas in which businesses could be doing more to protect themselves from a data breach.
According to the government’s cyber-security study, three-fifths of all firms surveyed (57%) have attempted to identify cyber security risks to their organization, for example through health checks or risk assessments (up from 51% in 2016). However, as in 2016, a huge amount of businesses still do not have basic protections or formalised incident management plans.
Whether sophisticated or not, a cyber attack has the potential to not only wreak havoc on your finances but also do great damage to your commercial (and in some cases, personal) reputation.
If you don’t believe me, ask Emmanuel Macron, the newly elected French President. Only 2 weeks before the final election, nine gigabytes of emails from Macron’s En Marche party spilled onto the web in a collection of torrent files.
It seems no one is safe from a data breach in this brave new world, so raising awareness and revising your security strategy couldn’t be of greater importance for businesses.
Now, with the new EU General Data Protection Regulation (GDPR) looming on the horizon, taking action is no longer a choice. Under this new regulation, any data that can personally identify an individual will always belong to that individual. That means as a business owner, you are responsible for ensuring all records of customer data of all formats are unified and protected from a potential data breach.
The GDPR also states that organisations must notify the relevant authorities (as well as the individuals affected) within 72 hours of a security breach, a short window of time that will push businesses to devise airtight response plans in the face of potential attacks.
Coming into force from May 2018, the EU GDPR introduces a strict compliance regime with fines of up to 4% of worldwide turnover for breach of the regulation. If that wasn’t bad enough, Data Protection Authorities will make a point to publicly name and shame companies who fail to comply.
So, whether you fear TheDarkOverlord or the Government, both should drive you to improving your business’ cyber-security profile.
How can our lawyers help your business?
As cyber attacks continue to grow in sophistication and potential, the time to improve your business’ cyber-security profile is now. The phrase “better safe than sorry” applies here.
Security resources for entrepreneurs and small business owners are plentiful, thankfully. However, knowing where to start can be a challenge.
With extensive experience in Internet and technology law, you can rely on 360 Business Law to help devise a robust security strategy and keep you compliant with the GDPR.
Our industry-leading business lawyers are available around the clock to help you implement a data protection strategy that reduces your overall risk profile and ensures your business hasn’t left the door open for cyber-criminals.
For more information on protecting your business from data breaches, read our blog on Cybersecurity. For specialist legal advice on data protection, get in touch with our business lawyers today on 01276 804432.