Top 11 cyberattacks that impacted 2024

2024 is behind us, but the cybersecurity lessons it left behind are still highly relevant. Data breaches remain a persistent threat to large enterprises and government agencies, as the data they store is prized by organizations and a prized target for cybercriminals. Attacks have economic consequences and serious reputational and legal repercussions, putting business stability at risk.
Analysis of the most significant cyberattacks over the past year shows that the failure to apply basic cybersecurity principles, including access protection or vulnerability management, still lies behind many of these breaches. As malicious actors' technologies and tactics evolve, ensuring you build solid cybersecurity foundations is the only way to mitigate the risks and reduce the impact of these incidents. That's why reviewing the most prominent cyberattacks of 2024 helps us gain valuable insights into how these threats are growing and changing and why reinforcing basic cybersecurity principles remains essential to addressing them.
The most significant cyberattacks of 2024
Last year, a substantial number of high-profile attacks were reported; we highlight the most relevant incidents below:
- Traffic hijacking at Orange Spain: at the beginning of the year, Orange Spain suffered a BGP (Border Gateway Protocol) traffic hijacking attack, in which cybercriminals redirected part of the telecom’s customers' Internet traffic to unauthorized servers. This incident caused significant service disruption.
- Children's Hospital Ransomware: The Rhysida ransomware group attacked Lurie Children's Hospital in Chicago, stealing 600 GB of sensitive data, including patient data, and demanding a ransom of 60 bitcoins, equivalent to approximately $6 million at the time. As a result, medical services were disrupted, spotlighting the healthcare sector's vulnerability to cyber threats.
- Large-scale phishing of Apple users: In March, a sophisticated phishing campaign targeted Apple device owners. Hackers employed an MFA fatigue attack, bombarding users with fake password reset requests to overwhelm and confuse them and gain access. They also impersonated Apple technical support through fraudulent calls, pressuring victims to reveal sensitive information.
- Backdoor in XZ Utils: In March 2024, a backdoor was discovered in versions 5.6.0 and 5.6.1 of XZ Utils, a data compression tool widely used on Linux systems. This vulnerability allowed malicious actors armed with a specific private key to gain unauthorized remote access to affected systems. Fortunately, the compromised version had not been widely deployed on production systems. The incident underscores the importance of software supply chain security and the need to verify the integrity of updates before deployment.
- Large-scale brute-force activity targeting VPNs and SSH services with commonly used login credentials: A year-long campaign became more prominent in April, when Cisco Talos actively monitored a global increase in brute-force attacks against a variety of targets, including Virtual Private Networks (VPN) services. The brute-forcing attempts use generic usernames and valid usernames for specific organizations. The targeting of these attacks appears to be indiscriminate and not directed at a particular region or industry.
- Vulnerable employees at BBC: In May, the BBC, the British public service broadcaster, reported that cybercriminals breached its Cloud storage service, accessing pension plan data on more than 25,000 employees. Although personal information was exposed, no financial data or passwords were compromised. The cause of the incident is still under investigation.
- Serious reputational consequences for FBCS: In June, the U.S. debt collection agency FBCS reported a major data breach exposing highly sensitive information such as the names, Social Security numbers, or identity documents of more than 3 million individuals. The delay in notifying the threat generated criticism and cast doubts on the agency’s security protocols.
- Transport for London (TfL) cyberattack: In September 2024, TfL suffered a cyberattack that affected key services such as contactless payments and Oyster cards. However, the impact on buses and the Underground rail services was limited. The data of 5,000 people, including some banking information, was compromised. The incident cost TfL £5 million in response and security measures. Subsequently, a 17-year-old was arrested in connection with the incident.
- Ransomware at Casio: In October 2024, Casio was the victim of a ransomware attack by the Underground cybercriminal group. The attack stole personal data belonging to employees, candidates, and customers, including financial details and legal documents. Although some services were disrupted, the company assured that no payment information, such as credit cards, was exposed.
- Ransomware at HACLA: In November 2024, the Cactus ransomware group hacked the Housing Authority of Los Angeles (HACLA), stealing 891 GB of data, including financial documents, backups, and customer and employee personal data. This incident exposed a large amount of confidential information, raising concerns about public sector security.
- Attack on Finastra: In November 2024, Finastra, a financial technology giant, suffered a breach on its file transfer platform (SFTP). A malign actor used compromised credentials to access and steal 400 GB of data, which was then sold on dark web forums. The company isolated the affected system and continues investigating the incident with cybersecurity experts.
These 11 cyberattacks represent a small sample of the challenges we faced during 2024 and focus on how threats continue to evolve and impact businesses of all types. Throughout the year, common patterns were observed, such as the recurring use of ransomware for extortion, exploitation of vulnerabilities in the software supply chain, and social engineering tactics such as phishing and MFA fatigue attacks. In addition, breaches related to improper access to data in Cloud storage services and critical platforms were flagged.
Against this backdrop, adopting a comprehensive cybersecurity approach is crucial in addressing these threats. This approach combines advanced tools with a strategy focused on prevention, continuous monitoring, and rapid response capability. By prioritizing these measures, organizations not only reduce risks but also strengthen their resilience in an increasingly challenging environment.