More cyberattacks, but less severe: these are the most exposed places
The Cybersecurity Agency notes that the most common technique is deception through fake emails, SMS or messages.
BarcelonaThere are more cyberattacks, but they are now less serious. This is the assessment made for 2024 by the Catalan Cybersecurity Agency, the body that protects the computer systems of the Generalitat (Catalan Government). Last year, this entity had to manage a total of 3,372 attacks that had some type of impact on the network. Most were minor, such as credential leaks (phishing) or unauthorized access to email. These technological intrusions that put the security of Catalonia's technological system at risk have increased by 26% compared to 2023, when 2,665 were recorded.
"We will receive millions and millions of cyberattacks, as many as 6.9 billion in 2024, 38% more than in 2023. But a cyberincident is what a cyberattack actually does," summarizes Laura Caball, director of the Catalan Cybersecurity Agency. In other words, it has consequences for users. Despite this upward trend, Caballero points out that incidents classified as "very serious" decreased by up to 30%. "Protection, detection, prevention, and awareness measures are effective," adds the Agency's director.
Caballero attributes much of the success to the introduction of improvements in the early detection of cyberattacks in the Generalitat's data processing centers (CPD) and a new system for blocking malicious emails in the mailboxes of government employees. In addition, the Agency has incorporated universities and the Consortium of University Services of Catalonia (CSUC) under its umbrella, a network that currently includes 312 entities, including hospitals and city councils.
Following the cyberattack perpetrated by the RansomHouse group that collapsed the Hospital Clínic in 2023 and leaked 4.5 terabytes of information of patients, workers and the operation of the center, the Agency has carried out 60 simulations in public hospitals in Catalonia. It has also carried out five communication campaigns aimed at citizens to raise awareness about cyber scams, which have been on the rise in recent years. Artificial intelligence is the new helper of cybercriminals, and although there are regulations that prevent tools like ChatGPT from providing information for malicious activities, it's easy to trick them into obtaining the desired information. In fact, according to the public agency, cybersecurity incidents related to the use of AI have increased by 370% worldwide since 2022. Through this tool, you can obtain malicious programs without being a programmer.
Universities and healthcare centers
The most common type of cyber incident is credential leaks, which are when cybercriminals use techniques such as fake emails, SMS, or messages to trick people into giving away their passwords and usernames. Some pretend to be banks or the Treasury to ask users for banking credentials in order to gain direct profit. Last year, there were 2,257 cases. Other notable incidents include illegitimate access to personal or corporate accounts (724), identity theft in fraudulent emails (117), and the distribution and execution of malicious software (102).
Another source of information leakage is when malicious programs are installed on devices to hijack computer files and demand a ransom (ransom, in English) to release them. Once they have the credentials, cybercriminals try to break into the accounts to steal information. According to Caballero, this type of attack accounts for 67% of cyberincidents, with 2,257 cases.
Universities are the most attacked area, with 1,790 incidents. In these spaces, there are students who use their personal devices and who lack adequate protection measures. By using university Wi-Fi, which is under the protection of the Agency, the Generalitat can identify attacks when students use the network on their personal devices. The other most affected areas are Health, with 676 cyberincidents, and other departments of the Generalitat (643).
![Laura Caballero, director of the Cybersecurity Agency of Catalonia.](data:image/svg+xml,%3Csvg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1600 1200"%3E%3C/svg%3E)
When should you be most vigilant to avoid cyberattacks? According to Caballero, it's especially important during specific shopping seasons, such as Christmas, Black Friday, or in the summer, when people book travel and hotels. "There's a clear correlation, as they time their attacks to coincide with these periods because they seem more credible," she asserts. The director of the Catalan Cybersecurity Agency insists that if you are a victim of cyber fraud, the main recommendation is to report it to the Mossos d'Esquadra (Catalan Police), because "the only way to track and profile cybercriminals is to have information." Caballero also urges improved protection, awareness, and detection measures to "identify attacks as quickly as possible and be able to respond as quickly as possible so that the impact of the incident is zero."
The Mossos d'Esquadra (Catalan Police) emphasize the importance of being wary of messages and calls and verifying their origin before making any move that could put personal data in the wrong hands. They also recommend creating strong passwords with more than eight characters and special symbols and changing them frequently. Likewise, it's important to change your password and router name frequently, and avoid public networks and Wi-Fi.
It's important to keep your devices updated, as system improvements include stronger security measures. Despite the updates, it's important to be vigilant when shopping online, especially when offers appear, as they may be malicious copies of real websites. You should also be careful with scannable QR codes and disable Bluetooth when not in use.
If a digital scam occurs, the Mossos d'Esquadra recommends deleting bank accounts and cards, as well as changing all critical passwords. It's also important not to delete conversations so they can be shown when reporting the scam.
