Cyber attack: ‘Reasons for startups’ data breaches go beyond lack of focus on securing apps, websites’
Hackers are becoming more and more interested in the data of Indian consumers. 2020 saw a series of startups' data breaches which left consumers and even businesses asking one question - How secure are we?
More than 90 per cent of advertisements on the dark web are about paying hackers to hack databases of businesses.
- By Shikhil Sharma
India’s technology ecosystem is growing at a massive rate. Home-grown startups are going global and global giants are coming to India to build for the next over 500 million users which are supposed to connect to the internet in the coming years. India is one of the most talked-about technology ecosystems in the post-COVID world as 2020 clearly saw some rebellion against China. While all these great developments are happening, hackers are also becoming more and more interested in the data of Indian consumers. 2020 saw a series of data breaches on Indian startups which left all of the consumers and even businesses asking one question – How secure are we? Well! The answer is – our app ecosystem and businesses are not fully secure. But are Indian businesses taking security seriously post the recent hacks? Yes! Thankfully, startups especially in the tech space are clearly taking steps to ensure they’re secure.
Some recent hacks on Indian apps & businesses
- Juspay, a payment processing company faced a breach that led to a leak of over 35 million records! A huge hack that really shook the industry.
- Unacademy, one of the most talked-about revolutionary startups in the tech industry faced a breach causing a data leak of more than 20 million records.
- Whitehat Jr, another startup in the education space suffered a breach leaking over 250,000 records.
- Dunzo, the go-to delivery company also suffered a breach.
- BigBasket also got hacked in 2020 after which they took some strong measures to strengthen security.
- Quite recently there have been signs of attack on Indian power grids by China. While this doesn’t exactly count attacks on ‘apps’ or ‘businesses’ but this one just can’t be ignored considering the severity. While this news made rounds and left the entire country in shock, what shocked even the security community was that there are chances that the attack happened way back in May 2020. Apparently, it took more than six months to even detect malware!
While these were some of the top startups of the country that suffered a breach, there are hundreds of websites and apps that get hacked every day which do not come in the mainstream news.
What caused this sudden rise in hacks?
Truth be told, this was long coming. Businesses have not been focusing on securing their apps and websites from day one. With multiple factors combining and COVID 19 happening, hackers got the perfect opportunity to exploit the vulnerabilities.
Rapid growth: Thanks to access to so much capital, the Indian tech industry grew massively over the last few years. Users of these apps grew at a fast pace, but security sadly wasn’t the core focus. New servers were added, which were often configured badly causing leaking critical configuration files and keys. New features were pushed to production, without testing them for vulnerabilities. Hackers often keep an eye on growing businesses because they know security won’t be a core focus and that’ll be a sweet spot for them to get in.
State-sponsored: In 2020, Australia saw a state-sponsored attack on them. This means that their entire country was being attacked including government and private sectors. The one on Australia was like the power grid attack India saw but at a national level. With ‘cyberwarfare’ being talked about so much, countries definitely seem to be strengthening their cyber strategies, and some of them already being offensive. Imagine being a tech-savvy person in a country and getting paid by your government to hack other governments? That’s what state-sponsored attacks look like.
COVID-19: Due to COVID, the business had to go all remote overnight. Businesses not only have to come up with a new operations strategy but also ensure their employees are smoothly transitioned to the new reality. Hackers took advantage of this weak situation and targeted businesses that did not have enough time to set up secure access to their infrastructure for employees to access from anywhere.
Lack of regular security audits: It’s always better to hack your app/website/network before hackers do. Regular security audits are the key to ensuring that new features added or new servers added to infrastructure are secure.
Sectors that need to be more cautious
On the dark web, since COVID 19 there has been a rise in demand for data. More than 90 per cent of advertisements on the dark web are about paying hackers to hack databases of businesses. Clearly, there are a few businesses that are more on the radar due to the sector they’re in and the kind of data they handle.
BFSI: Attack on Juspay and leak of more than 35 million records tells us that hackers are going to hit where it hurts the most.
Government: With the rise of state-sponsored attacks, governments should be super focused on security for their infrastructure apart from making the right policies around cybersecurity.
Consumer startups & E-commerce: Businesses directly catering to consumers handle have a lot of sensitive data which lures hackers. Right from payment information to location information – everything needs to be protected.
Healthcare: Business and apps which directly deal with patient records or medical details of people should be super cautious about their security. We’ve been tracking a rise in attacks on healthcare startups especially in the post COVID world where a lot of preliminary medical consultation happens online.
Comments