More Cyber Criminals Turn to Extortion

After years of stealing data for fraud and corporate espionage, hackers increasingly are trying a new way to profit from their digital break-ins: extortion.

Hacks involving HBO and Netflix in recent months have shed light on the extortion threat, which law-enforcement officials and companies that investigate these digital break-ins say has been on the rise in recent years.

Instead of simply stealing passwords or credit-card data, or locking access to victims’ systems as with ransomware, extortionist hackers try to unearth corporate secrets that they then threaten to make public if victims don’t pay.

Because the extortionists threaten to expose sensitive material, the crime can be “more damaging and impactful to victim organizations than other types of theft of intellectual property,” said Charles Carmakal, a vice president with cyber investigations firm FireEye Inc.

Adding to the insidiousness of cyber extortion, those targeted by such efforts often cannot tell how much data the hackers really have. In some cases, the extortion attempts are bluffs, he said.

FireEye noticed the uptick in extortion cases in 2015. In 2016, the number of cases doubled.

Extortion attacks in the past year have hit medical clinics, which hackers threatened with leaking patient information; casinos, where they threatened to divulge client lists; and energy companies, where hackers have shut down systems needed for mining operations in an extortion episode and threatened to release confidential business contracts and employee data.

Extortion attacks are a cousin of ransomware hacks, which render computer files unreadable until a payment is made.

Source: Wall Street Journal