₹7.3 crores!
That’s how much money hackers took from Razorpay, an Indian fintech company, over three months.
Razorpay is a payment gateway provider for the uninitiated. When you’re trying to pay for pizza on your favourite food delivery app, for example, they enable payments. It’s something they excel at. However, hackers managed to penetrate the payment verification procedure one of these days, and it appears that they got off with 7.3 crores in the process.
Razorpay now claims that no other parties have been harmed as a result of this, but we have to wonder, “Why isn’t this big news?” “Why isn’t this being discussed more?”
Well, let’s face it, the truth is… The ecosystem has grown accustomed to it. At the very least, Razorpay has been open and honest about what happened. However, the majority of businesses do not even acknowledge data breaches. News sources have claimed that JusPay, Pinelabs, and MobiKwik have all experienced data breaches in the last several years and that not everyone has been honest about the incident. At least not until it was discovered by independent researchers.
You can see why they’re apprehensive about doing this. After all, it’s not a good reflection on your company. However, because we lack strict guidelines on matters like these, some businesses can get away with the most heinous practices. And the ramifications are enormous. They have access to millions of bank accounts and credit card credentials in one location, thanks to a simple breach. And, more often than not, the information ends up on the dark web, a type of cyber underworld. It’s then sold to the highest bidder there. Credit card information, for example, is sold for $12 to $20. In addition, stolen banking credentials with a minimum balance of $2000 can sell for an average of $65 on the black market.
However, data breaches aren’t the only concern for businesses. Then there’s Ransomware.
As we already stated,
Ransomware is a type of malware that encrypts (or locks) your data. If the code runs successfully on your device, you may never be able to recover your files. Unless you have access to a unique key, which will only be released if you pay the ransom demanded by the people holding your data hostage.
In some circumstances, the attackers will take things a step further and threaten to post important information on the internet if their demands aren’t met. Then you have two choices: either give in to their demands, pay the ransom, and hope they decrypt your files for you, or risk dealing with the consequences alone.
Ransomware assaults were recorded by 78% of Indian firms polled in a report assessing the impact of ransomware on 5,600 mid-sized organisations spanning Europe, the Americas, Asia-Pacific, and Central Asia. And they had to pay a total of $1.2 million for each attack. It’s completely insane.
So, why are these breaches and ransomware assaults occurring at such alarming rates? Aren’t we well-equipped to deal with these rogues?
To begin with, there’s the digital revolution. Because of the pandemic, the work-from-home paradigm was born, and security dangers are no longer limited to the perimeter of an office structure. Meanwhile, hackers are adjusting to the situation by attacking flaws in “secure VPNs and other collaborative technologies.”
And, in certain cases, the ‘user’ is the weakest link in the system, regardless of how sophisticated the cybersecurity solution is. A single employee’s click on a dodgy link or opening unsolicited emails could bring the entire IT infrastructure of the company to a halt.
There’s also the issue of building too quickly these days. Fintech companies are being driven to take shortcuts to ship products within a certain time frame. As a result, security holes emerge.
Perhaps the only good news? Politicians are attempting to catch up.
For example, there are currently no breach disclosure policies in place in our country. Companies might opt to disclose a breach to the Ministry of Electronics and Information Technology’s Computer Emergency Response Team (CERT-IN). They are not, however, compelled to do so.
In other regions of the world, however, this is not the case. In the EU, for example, corporations must report security breaches within 72 hours. As a result, without a requirement to report data breaches, we may not even be aware that our personal information has been exposed.
But that’s changing, as CERT-In has introduced its data breach policy, requiring enterprises to report security breaches within a six-hour deadline. These new regulations are expected to take effect in July and will hopefully shed more light on cybersecurity issues.
The government has also increased its budget for cybersecurity spending and is currently developing a National Cybersecurity Strategy to strengthen our defences.
Will all of this, however, be enough to counter evil actors’ attacks? Unlikely. They’ll adapt and hone their talents as well, and all we have to do now is be ready for the inevitable — businesses must be on their toes