January 25, 2016 By Douglas Bonderud 2 min read

Austrian airplane component manufacturer FACC AG isn’t having a great month. According to CSO Online, the company’s newly released 2015 third-quarter results report spelled out a recent cyberattack on the accounting department of its FACC Operations unit. This is no small theft: Criminals flew the coop with more than $50 million in liquid funds.

While FACC AG said the loss does not pose an economic threat to ongoing company operation, it’s a wake-up call for other enterprises: Large-scale cybercrime is off the ground and gaining altitude. Is it possible to avoid financial free fall?

Cybercrime Goes Up, Up and Away

While FACC AG hasn’t been forthcoming with the details of the breach, it has assured investors that IT infrastructure, data security and intellectual property rights all remain secure. Speculation about the outflow of significant assets suggested the use of fraudulent wire transfers — once completed, it’s almost impossible to reclaim money even if criminal intent is proven. With criminals developing new email compromise and login theft techniques, these transactions often appear legitimate long enough to fool financial professionals.

As noted by Live Mint, fraud-based cybercrime is rising worldwide. A recent Ernst & Young report found that cybercrime is the fastest-growing fraud risk in India, while Data Quest predicted that mobile cyber fraud will become a serious problem for businesses across the country in 2016. In other words, although FACC AG’s loss is noteworthy owing to its size, this type of cyberattack is quickly becoming commonplace.

On Solid Ground

So how do companies mitigate the threat of cyber fraud losses, especially when attackers are so good at getting in, stealing cash and escaping notice? One option is beefing up internal security controls, hiring more IT security staff and piling on cybercrime budgets to help track down possible fraud indicators. Here, the biggest motivator is fear: Companies don’t want the public or competitors to know they’ve been hit, how much they’ve lost or if their systems contain potential vulnerabilities.

There might be a better way. In Canada, top industry leaders have created a new network — the Canadian Cyber Threat Exchange (CCTX) — set to launch in the next few months, according to the CBC. This independent, nonprofit organization will act as a “clearing house” for companies to report cyberattack vectors, malware types and even cybersecurity responses. Ideally, the exchange should help all CCTX members become better prepared and better equipped to handle emerging cybercrime threats.

Bottom line? No company wants to admit it has lost millions to fraud thanks to an IT breach. What if competitors take advantage or consumers abandon ship? But this kind of thinking is like grabbing your luggage when the plane is going down; no one walks away if the aircraft hits the ground. Data shared offers the chance for money saved. If companies want out of the cybercrime free fall, it’s time to be forthright.

More from

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

New proposed federal data privacy law suggests big changes

3 min read - After years of work and unsuccessful attempts at legislation, a draft of a federal data privacy law was recently released. The United States House Committee on Energy and Commerce released the American Privacy Rights Act on April 7, 2024. Several issues stood in the way of passing legislation in the past, such as whether states could issue tougher rules and if individuals could sue companies for privacy violations. With the American Privacy Rights Act of 2024, the U.S. government established…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today