Most of us don’t think twice about banking online, setting up automatic e-payments, or using web-based customer account logs. Using the internet is an integral part of daily small business operations. However, it doesn’t come without risks. We’re all vulnerable to various types of cyberattacks — and that includes small businesses.

When you’re a business owner, the stakes are higher. You’re responsible for protecting yourself and the sensitive data belonging to your business, customers, and employees. An excellent first step in due diligence is understanding the different types of cyberattacks that could hit your business.

The 10 types of cyberattacks

Cyberattacks come in many forms. Here’s a look at different types of attacks in cyber security.

1. DoS & DDoS

Imagine that suddenly none of your customers can access your website. That’s what happens when you’re the victim of a denial of service (DoS) attack. Hackers flood your server with bogus requests for information or site visits — many more than it can handle.

It doesn’t stop there. DoS attacks have evolved into distributed denial of service (DDoS) attacks. These involve multiple systems working together to perform a DoS attack on a single target. They are harder to stop and cause more damage because they come from multiple machines in various locations.

How a DoS or DDoS attack works

Normally, a web user makes a single request to access your business’s website. Your web server responds to verify the user, and the user’s computer verifies itself to continue to the desired page.

With a DoS or DDoS attack, hundreds of thousands of requests are sent at once. Your server requests verification from all of them and waits for answers but never gets them. Then, another flood of requests is sent.

The massive amount of requests slows down and eventually stops your server’s ability to verify real users. A famous cyberattack example occurred in February 2020, when an attacker tried to launch the largest-ever DDoS attack on Amazon, but the internet giant used its cyber security defenses to mitigate the attack.1

2. Malware & ransomware

Malware attacks involve cybercriminals using malicious software to perform unauthorized activities on your computer, phone, or system. Further, ransomware attacks are a type of malware often used to block computer access or release data unless a victim pays a ransom.

How a malware or ransomware attack works

You can accidentally download malware and ransomware by following a link, clicking an ad, or opening an email attachment. During a ransom attack, the hacker often locks the computer or device and encrypts its data.

The perpetrator demands that victims of ransomware attacks pay money or provide some other value by a deadline to restore their devices and data. For example, computer manufacturing company Acer fell victim to a ransomware attack in 2021. The hackers gained access to Acer’s files, leaked sensitive financial data, and demanded a $50 million ransom.2

3. Man in the middle

As the name suggests, a man in the middle (MITM) attack involves three parties; the victim, the entity a victim wants to reach, and the cybercriminal. This kind of attack can involve the criminal intercepting your data through a shared Wi-Fi connection or by using malware.

How a man-in-the-middle attack works

There are various ways this type of cyberattack can work. One of the most common is phishing (more on that next). Once malware is installed, the hacker can record and access data sent between you and the websites you visit.

For example, in July of 2021, between 800 and 1,500 businesses were affected by a malware attack targeting Kaseya, a software management company. Hundreds of supermarkets had to close because their registers wouldn’t work.3

Another common MITM approach is for criminals to find a vulnerable Wi-Fi router with a weak password (Password123, anyone?) and deploy tools to intercept your data, such as log-in credentials and private business information.

4. Phishing

A phishing attack involves an attacker posing as a reputable company or person and trying to collect valuable information like credit card numbers and passwords. These attacks are common via email but can also happen over the phone or in text messages.

How a phishing attack works

Cybercriminals will often pose a legitimate institution and attempt to lure victims into sharing their information. They may do so with lucrative, so-called limited-time offers. However, signs of a phishing scam include hyperlinks or sender email addresses with misspellings and unexpected attachments.

A recently reported phishing scam involves cybercriminals who email victims asking if they want to keep their Office 365 details intact. When they click on the link, the victim is taken to a fake Office 365 sign-in page where the attackers then try to steal credentials.4

5. Drive-by

A drive-by cyberattack happens when you encounter a malicious script that causes a program or file to be downloaded and installed on your computer without your permission. This attack doesn’t require you to open an attachment, press download, or click anything. Drive-by downloads are often designed to crash your device or spy on your activity.

How a drive-by cyberattack works

You could become the victim of a drive-by cyberattack just by visiting a web page. The hacker can plug a malicious component into a website that looks for security gaps in your computer or phone. If it finds one, it downloads the malware, and hackers can begin to control, disrupt, or steal data from you.

At the end of 2020, Microsoft discovered and reported a massive drive-by attack named Adrozek that targeted Chrome, Edge, and Firefox users. Researchers found 59 domains distributing hundreds of thousands of Malware samples.5

6. Password attack

This type of attack involves cybercriminals attempting to access password-protected accounts to steal information or otherwise cause disruptions.

How a password attack works

There are a variety of ways that criminals can attempt to hack passwords. They include:

  • Brute force: Using software to try every possible combination of a set of allowable characters.
  • Dictionary attacks: Passwords are guessed based on commonly used passwords and variations of words found in the dictionary.
  • Previously breached: Breached usernames and passwords are used on several other websites in hopes that the account holder will reuse them.6

In a recent example of a high-impact password attack, hackers gained access into the networks of the Colonial Pipeline Co. through a virtual private network (VPN) account. The result? The takedown of the largest U.S. fuel pipeline and fuel shortages across the East Coast.7

7. SQL injection

Structured Query Language (SQL) is a standardized language used to access and manipulate databases. It enables different users of a system to have a customized data view.

SQL injection attacks involve using a malicious SQL code to expose information that’s not supposed to be displayed. As a business owner, this could mean compromised private customer details, user lists, or other types of sensitive company data.

How a SQL attack works

There are multiple ways to get into a database, including submitting forms with SQL statements. Attackers use SQL injections to break into websites, social media platforms, and businesses to cause disruptions.

For example, a team of attackers used SQL injections to break into 7-Eleven’s corporate systems and stole 130 million credit card numbers.8 In another case, a group used SQL injections to break the Turkish government website and erase debt to government agencies.9

8. Cross-site scripting

Cross-site scripting (XSS) happens when an attacker injects a malicious script into a trusted website or web application. XSS attacks can expose end-user files or redirect traffic to another site when the script goes undetected by browsers. Additionally, they can allow hackers to change your website content (e.g., product information, prices, and press releases).

How a cross-site scripting attack works

XSS attacks can happen in a few different ways, including:

  • Stored XSS attack: The script is permanently stored on target servers in places like message forums or comment sections.
  • Blind XSS: The script is sent to the site administrator and is executed once opened. This can happen via a form submission.
  • Reflected XSS attacks: The webserver reflects the script is reflected in a response such as a search result or error message.

In 2019, the popular video game Fortnite had a retired unsecured web page that was vulnerable to XSS. As a result, it allowed unlimited access to 200 million users. Attackers could steal the game’s virtual currency along with the recorded conversations of players.10

9. Eavesdropping

Similar to a nosy person listening in on a conversation, an eavesdropping attack involves a cybercriminal “listening in” on your online activity and stealing information as it’s transmitted from your device over a network. Unsecured network communications and a lack of security measures on personal devices can leave you vulnerable to this type of attack.

How an eavesdropping cyberattack works

An eavesdropping attack relies on insecure or vulnerable networks (like Wi-Fi hotspots) and is most common with wireless communications. Attackers often look for sensitive data such as log-in credentials and confidential corporate data.

10. Birthday

The birthday attack comes from the birthday paradox problem: The probability that two people will share a birthday in a set of randomly chosen people.

Cybercriminals exploit the mathematics behind the birthday problem to crack cryptographic algorithms by finding matches in hash functions. Did we lose you? Let’s put it this way: You don’t need to know what a cryptographic algorithm or hash function is to know you could be vulnerable to the birthday attack.

How a birthday cyberattack works

Attackers use the same probability theory to solve the birthday problem to reduce the complexity of finding two input hashes that map to the same output hash (a hash collision). They also use it to figure out the approximate risk of the existence of a hash collision within a given number of values. In short, it tells them how much work it’s going to be to crack a code and is often used to create fraudulent contracts.

Cyber insurance: Financial protection against all types of cyberattacks

Similar to protecting a brick-and-mortar business against various risks such as burglary, theft, and natural disasters, you can protect your online business activities against the financial consequences of the most common cyber attacks.

Cybercriminals continually look for any cracks they can find to slip through and gain access to your sensitive information, so types of hacking attacks are evolving. All the more reason to make sure your small business is continually protected. Cyber insurance helps to protect you against the financial liabilities that result from all types of cyberattacks. Whether it impacts your business, your customers, your employees, or all of the above, you can rest assured that the costs don’t have to come entirely out of pocket.

Ensure all your bases are covered so your business can thrive for years to come. Learn more about small business insurance from Thimble, the smarter and simpler way to safeguard your business. Click “Get a quote” or download the Thimble mobile app, answer a quick set of questions, and get covered within minutes.

Get a quote

Sources:

  1. BBC News. Amazon thwarts largest-ever DDoS cyber-attack. 
  2. Forbes. Acer Faced With Ransom Up To $100 Million After Hackers Breach Network.  ​​
  3. Reuters. Up to 1,500 businesses affected by ransomware attack, U.S. firm’s CEO says. 
  4. Computer Weekly. Experts warn on Office 365 phishing attacks. 
  5. Forbes. Microsoft Warns Of Massive New ‘Drive-By Attack’ Targeting Chrome, Edge, Firefox Users. 
  6. Center for Internet Security. Election Security Spotlight – Password Attacks. 
  7. Bloomberg. Hackers Breached Colonial Pipeline Using Compromised Password. 
  8. Bloomberg. Theft of 130 Million Credit Cards Tied to Miami Man. 
  9. Researchgate. Hactivism in Turkey: The Case of Redhack. 
  10. Cnet. Fortnite had a security vulnerability that let hackers take over accounts.