Ransomware may have been the most prevalent internet threat of 2016, and WannaCry certainly made it a mainstream conversation, but that doesn’t mean people are reporting incidents to law enforcement.
The FBI’s Internet Crime Complaint Center’s annual report published this week counted only 2,673 victims in 2016 and losses of nearly $2.5 million. These numbers are dwarfed by incidents such as data breaches, phishing, extortion, Business Email Compromise and more.
Earlier this year at the Source Boston conference, a detective in the Boston Police Department’s cybersecurity division cited this issue as well on a local law enforcement level.
“We get a couple of calls here and there but people mostly don’t want to report it to the police because if they fill out a police report it becomes public record,” Frank McLaughlin said.
Enterprises and small businesses alike have historically been hesitant to share any breach or intrusion data unless compelled to do so by either industry regulation or law. The FBI, meanwhile, last September urged ransomware victims to tell the feds about attacks. The bureau provided a forum for victims to share data about attacks including incident dates, variants, how the infection occurred, ransom demands and whether payment was made. But apparently, the call wasn’t heeded on any kind of scale.
Federal authorities have many more resources to deal with ransomware infections than local law enforcement officers, who according to the panelists at Source Boston are awash in so many criminal complaints on a day-to-day basis that impact physical and personal safety that digital crimes are lost in the shuffle.
In the meantime, ransomware continues to escalate in capabilities, and now with the public availability of nation-state exploits such as EternalBlue, which spread WannaCry, experts believe this will only accelerate the rate at which ransomware spreads.
The FBI report singles out three other threats in addition to ransomware: business email compromise, tech support fraud, and extortion.
Business email compromise are usually social engineering attacks targeting executives, eventually fooling them into signing over massive, fraudulent wire transfers. The FBI counted 12,005 BEC victims and losses of more than $360 million. Tech support fraud is a threat to consumers who fall for these scams through cold calls, poisoned search results, typosquatting or URL hijacking. The scam is generally the same where the criminal attempts to gain the victim’s confidence and remote control over their computer in order to load malware, steal personal information, or access to bank accounts. The FBI said it accounted for more than $7 million in losses.
The extortion threat encompasses denial of service attacks, data breaches and loan schemes where victims are threatened in some way with physical or financial harm. The FBI said it received 17,146 complaints and recorded losses of $15 million.
