Hacktivists stole 58% of thieved data in 2011

Anonymous and other "hacktivist" groups rose to new prominence in the cybercrime universe last year, and a new report shows that they made some serious mischief. Verizon's (VZ, Fortune 500) annual Data Breach Investigations Report, released Thursday, found that hacktivist groups were responsible for 58% of all data stolen last year. The telecom giant compiled data breach information from its customers and from law enforcement agencies in five countries. The hacktivists' success is partially due to the sharp rise in the number of attacks Anonymous and its peers launched last year. Verizon, which has been tracking hacktivist activity since 2004, said that last year's collection of hacktivist breaches exceeded the total from all previous years combined. That trend is "probably the biggest and single most important change" in this year's report, said Bryan Sartin, head of Verizon's data breach investigations team. When online hacktivism first started in the 1990s, most of what the attackers accomplished were website defacements and denial of service attacks -- annoyances more than serious problems. But last year, Verizon began to notice what it calls a "major shift" in hacktivist activity. In addition to their usual methods, Anonymous and its cohorts were starting to launch data breach attempts against their targets, in what became a new "core tactic" for the groups. "2011 saw a merger between those classic misdeeds and a new 'oh by the way, we're gonna steal all your data too' twist," Verizon said in its report. "This re-imagined and re-invigorated specter of 'hacktivism' rose to haunt organizations around the world." Here's a startling twist: Verizon found that in many cases the denial of service attacks served as diversions. The hacktivists would often publicly announce a big attack, and the target would dedicate all of its resources to stopping that. While that was happening, hacktivists would go in unnoticed and steal some company data. "It's the old bait-and-switch," said Sartin. "That concept, as basic as it seems, is a level of ingenuity we've never seen before." In all, hacktivist groups stole more than 100 million records last year, almost twice the amount of data captured by financially motivated cybercriminals. Still, just 2% of all attacks could be attributed to Anonymous and its peers. The vast majority of online data thieves remain professional criminals looking to steal information that can lead to money. So why did hacktivists manage to grab so much more data than the pros? Those big-time cybercriminals -- typically organized crime rings -- are usually surgical in their attacks. They take a "rinse and repeat" approach, stealing small chunks of data on a massive scale. Hacktivists, on the other hand, go after big organizations, since their goal is to get the public to notice them. Some prime targets of Anonymous and other hacktivists last year included News Corp. (NWS), Sony (SNE), PBS, the Federal Bureau of Investigation, Central Intelligence Agency, Department of Justice, and a multitude of security firms. The "good" news is that most of what hacktivists stole was relatively benign data. Customer lists of names, usernames and e-mail addresses were the most commonly grabbed data. Hackers were rarely able to capture -- or perhaps didn't go after -- more sensitive data like credit card information or passwords. But it wasn't all "protest and lulz," Verizon said. Sartin now thinks that hacktivists are a more significant threat than previously believed. "The numbers suggest clearly that people need to reevaluate how they view the capabilities of hacktivists," he said. "The tools, tactics and methods of advanced persistent threats and hacktivists are largely the same." Traditional cybercriminals are also upping their game. Cybercriminals last year went after end-user devices like ATMs, laptops and smartphones much more often than they did in previous years. Those devices accounted for 60% of all attacked targets, and Sartin said he wouldn't be surprised if smartphones make up the majority in 2012. In all, Verizon said it and its partners recorded 855 data breaches, encompassing 174 million compromised records. That represented the second-highest total since Verizon's report was first issued in 2004. To top of page