The phenomenon of our time, the one thing transforming professions, companies, and industries alike, is data. Naturally, when organizations around the world are in possession of such a precious resource, there will be people attempting to gain access to it, and maybe even take it away from the original owners. Since all this data is mostly stored on the internet, and the means to steal it are also carried out mostly via the internet, this art of stealing is commonly known in today’s world as a cybercrime. By definition, any crime committed using the means of technology and the internet is cybercrime.

The Scale of the Crime

The most important thing to note about cybercrime is the scale of the crime. Considering the example of a bank, a traditional bank robber may be able to hit one or two banks a week, while a cybercriminal can compromise hundreds, if not thousands of bank websites. Attacks are conducted at machine speed. An attacker can write code that will target multiple sources in minutes.  Many people may believe that cyber-attacks are successful only on small-scale companies and that large established corporates have a strong cyber threat response team, so they can never be hacked. This is not always the case. There are always chinks in the armour of any company. For example, in January 2019 the email giant Yahoo! reported that 273 million usernames and passwords were exposed to cyber attackers. In 2014, AT&T experienced an internal security breach, where three employees accessed customers’ personal information such as social security numbers and dates of birth. Members of the cybercrime group need not always be external sources, they could be employees of the company as well. Even the largest tech giant, Google, was victim to a cyber attack. In September 2014, approximately 5 million usernames and passwords of Gmail account holders were compromised and leaked on a Russian forum site. Of these, about 100,000 were legitimate, current, and correct username-password combinations. Due to the occurrence of many incidents like these, cybercrime is one of the FBI’s top three priorities today.

“Cybercrime is the greatest threat to every company in the world” Ginni Rommety

Read More: How Google Tracks You There are numerous ways by which an organized cybercrime is carried out. Each group may have its own unique method, but we can generate a high-level blueprint of the methodology used by most hacker groups to target an organization. First, a detailed study of the company and the services it offers is conducted. The domains in which the company works are studied and the strength of its cyber threat response team is also analyzed. After learning as much as possible about the company, members of the group physically try to penetrate into the company. This may be achieved by social engineering techniques such as establishing contact with employees of the company, befriending security personnel, or sending phishing emails to new employees of the company who are usually more vulnerable, tricking them into giving away sensitive information. Once a pathway into the network has been established, the hackers connect to the network, use penetration testing tools and skills to collect as much data as possible, and maybe even compromise the whole network. Malicious software may be deployed, or ransomware could be set up. Meanwhile, the data they have already collected can be sold to interested parties in the black market. Then, the hackers have to figure out a way to get out of the network and clear their tracks so that they are not caught, and a successful cyberattack is completed.