7 Most Famous Social Engineering Attacks In History
Social engineering attacks have been happening a lot, targeting individuals and organizations to gain unauthorized access to critical data. Such types of cyberattacks rely on manipulating human psychology rather than exploiting technical vulnerabilities.
Over the years, there have been many high-profile social engineering scams that have caused immense financial and reputational damage. In this article, we will look at 7 of the most famous social engineering attacks in history.
Kevin Mitnick’s Attack on Pacific Bell (1994)
One of the most notorious social engineers is Kevin Mitnick, who launched an attack against telecommunications company Pacific Bell in 1994. Mitnick managed to obtain the corporate access code for Pacific Bell’s voicemail system by posing as an employee.
He then broke into the voicemails of top executives to gather sensitive information. This enabled him to steal over $1 million worth of proprietary software. Mitnick was later arrested and convicted for this crime.
Such Social Engineering attacks could lead to major data loss but they can be tackled with the use of VPN with other cybersecurity measures. If you are using an operating system like KaiOS then you should use KaisOS VPN along with proper cybersecurity practices to prevent data loss.
Edmund du Plessis and the Eskom Scam (1994)
In 1994, computer auditor Edmund du Plessis carried out a scam against South African electricity supplier Eskom. Du Plessis sent faxes to Eskom posing as a high-level executive of Peers Chartered Accountants. He instructed Eskom employees to transfer funds to Peers’ bank account for investment purposes. Over 17 transfers, du Plessis was able to embezzle around $2.5 million from Eskom. This incident revealed how social engineering could be highly effective even before the internet era.
Sarah Palin Email Hack (2008)
During the 2008 US presidential election, anonymous hacker ‘Rubico’ targeted vice presidential candidate Sarah Palin in a social engineering attack. Rubico tricked Yahoo tech support into resetting Palin’s password using her birthdate, zip code, and information about where she met her spouse. This granted access to Palin’s personal email account. The hacker leaked screenshots of Palin’s emails to WikiLeaks, causing major embarrassment for the campaign.
RSA Breach (2011)
In one of the most advanced social engineering attacks ever, hackers targeted American computer and network security company RSA in 2011. They sent phishing emails with an Excel file to RSA employees. Once opened, the file installed a backdoor trojan on the victims’ computers. This granted access to RSA’s systems, enabling hackers to obtain data on RSA’s SecurID two-factor authentication tokens. This data was then used to infiltrate the networks of defense contractors Lockheed Martin and L-3 Communications.
Hackers exploited the uses of www with social engineering tools to gather information during the RSA breach and access confidential data. So companies must take the necessary steps to prevent such attacks in the future.
Syrian Electronic Army Hacks Media Sites (2011-2014)
Between 2011 to 2014, the Syrian Electronic Army (SEA), a hacker group loyal to Syrian President Bashar al-Assad, orchestrated numerous social engineering attacks on high-profile media organizations.
Their targets included the Twitter accounts and websites of the Associated Press, BBC, National Public Radio, CBS, NBC, Reuters, and satirical news site The Onion. The SEA tricked employees at these companies into handing over login credentials through carefully crafted phishing emails.
Once inside the media organizations’ social media and web infrastructures, the SEA posted pro-Assad messages and propaganda, even falsely reporting an explosion at the White House at the height of the Syrian civil war. The SEA’s hacking spree caused worldwide alarm and highlighted the media’s susceptibility to social engineering breaches.
$81 Million SWIFT Bank Heist (2016)
In 2016, hackers compromised Bangladesh Bank’s systems and initiated fraudulent money transfers totaling $101 million through the SWIFT interbank messaging network. Most transfers were blocked, but $81 million was still stolen – one of the biggest bank heists in history. Investigations revealed that hackers had installed malware via spear phishing emails targeting bank employees. The malware allowed the hackers to obtain valid SWIFT credentials for issuing transfer orders.
Twitter CEO Jack Dorsey Account Hack (2020)
In 2020, a group hacked into Twitter CEO Jack Dorsey’s personal Twitter account @jack. They posted inflammatory and racist tweets to Dorsey’s 4.2 million followers. The hackers gained access by convincing Dorsey’s mobile provider to port his number to one of their SIM cards through a SIM swap scam. Since Dorsey used SMS-based two-factor authentication, the hackers received the authentication codes and took over his account. This highlighted the weaknesses of SMS-based authentication.
What Is Social Engineering In Cybersecurity?
Social engineering refers to psychological manipulation tactics that hackers use to trick people into providing confidential information or access to a computer system. It exploits human vulnerabilities rather than technical weaknesses.
What Are The Most Common Types Of Social Engineering Attacks?
Hackers use all kinds of social engineering tricks like phishing emails, vishing phone calls, smishing texts, baiting freebies, quid pro quo deals, pretexting fake needs, piggybacking access, and tailgating entry. They’ll exploit any channel – email, phone, text, or in-person – to manipulate people into handing over confidential info or system access.
Who Is Most Vulnerable To Social Engineering?
All individuals and organizations are vulnerable to social engineering to some extent. However, employees who are not security-conscious or lack cybersecurity training are more susceptible. Stress and distractions also increase vulnerability.
How Can Companies Defend Against Social Engineering?
The most effective defense is security awareness training to teach employees to identify suspicious emails, unsolicited requests, and other red flags. Policies like prohibiting information sharing over the phone or email also help. Using authentication measures beyond passwords adds another layer of protection.
What Should You Do If You Suspect A Social Engineering Attack?
If you receive any unexpected or suspicious contact asking for information or requesting account access, do not provide anything. Report the incident to your IT security team immediately. Provide details like the source of contact and what information was requested.
Conclusion On Social Engineering Attacks
Social engineering has enabled some of the most high-profile cyber attacks in recent decades, often causing more damage than technical hacking alone. Attackers exploit human tendencies like trust, fear, curiosity, and a desire to be helpful in order to manipulate victims and bypass security measures.
The article provides an overview of 7 major social engineering attacks throughout history that led to significant financial losses or security breaches. By understanding these psychological tactics and exercising caution, individuals and organizations can better defend themselves against these non-technical threats.
Implementing ongoing education and strong policies are key to mitigating the risk of successful social engineering. As hacking techniques evolve, awareness and vigilance will remain essential to protecting sensitive systems and data.