Understanding Cyberattacks and Effectively Defending Against Them
How attacks originate, who is behind them, which methods are used, and how you can proactively protect your organization.
Explore Protection MeasuresReading time: 12 minutes
Cyberattacks affect organizations of all sizes: from startups to large enterprises, from hospitals to government agencies. The question is not if, but when, and how well you are prepared.
This page explains what cyberattacks are, how they work, and which protective measures organizations can take. We also recommend our pages on IT security & information security as well as vulnerability management.
ⓘ
Key Takeaway: A cyberattack is a deliberate attempt to compromise IT systems, driven by motives such as extortion, data theft, or political objectives. Consequences range from operational disruptions to insolvency. Prevention is more effective than response.
What is a cyberattack?
Cyberattacks are deliberate, malicious attempts to compromise IT infrastructures. Attackers aim to gain an advantage for themselves or a client, at the expense of their victims.
Operational Disruption
Targeted disruption of critical processes to damage revenue, reputation, or geopolitical stability, often used as leverage or diversion.
Data Theft
The exfiltration of trade secrets, customer data, or intellectual property, which is then used for extortion, espionage, or resale.
Financial Gain
Ransomware extortion, the sale of data on criminal marketplaces, and fraudulent transfers are among the most common financially motivated attack objectives.
The consequences range from short-term disruptions to existential threats: significant financial losses, reputational damage, loss of key business partners, regulatory sanctions, and, in extreme cases, insolvency.
Notable Cyberattacks of Recent Years
In recent years, cyberattacks have affected organizations of all sizes: from startups and Fortune 500 companies to government institutions and critical infrastructure.
2020
SolarWinds
Supply Chain
Supply Chain
Malicious code injected into the widely used Orion IT monitoring software compromised around 100 major organizations, including U.S. federal agencies and Fortune 500 companies. Considered one of the most consequential supply chain attacks in history.
2021
JBS Foods
Ransomware
Ransomware
One of the world’s largest food producers was forced to temporarily shut down production and packaging facilities. Ransom payment: USD 11 million. A clear example of the vulnerability of critical supply chains.
2021/22
Log4Shell
Zero-Day
Zero-Day
A critical vulnerability in the Apache Log4j library affected millions of IT systems worldwide. Exploited for ransomware, cryptomining, and espionage. To this day, one of the most severe known security vulnerabilities.
2023
MOVEit Data Breach
Software Vulnerability
Software Vulnerability
Vulnerability in the MOVEit MFT software: 2,700+ compromised organizations and 93 million affected individuals across healthcare, finance, and government sectors.
2024
Change Healthcare
Ransomware
Ransomware
Largest data breach in the U.S. healthcare sector: 192 million affected individuals, total damage of approximately USD 2 billion (including USD 22 million in ransom). Months-long disruption of medical billing across the United States.
Who Is Attacking? An Overview of Threat Actors
Not all attackers pursue the same objectives or have the same capabilities. Understanding the different types of threat actors helps to realistically assess your own risk exposure.
Cybercriminals
Financially motivated, often operating in highly organized networks. Common methods include ransomware, phishing, and identity theft.
Advanced Persistent Threats
Highly sophisticated actors using zero-day exploits and tailored malware. Often remain undetected within networks for months.
State-Sponsored Groups
Their objectives include espionage, theft of intellectual property, and sabotage of critical infrastructure, backed by significant state resources.
Insider Threats
Employees, contractors, or partners who cause harm either intentionally or unintentionally, ranging from data loss to active sabotage.
Script Kiddies
Less technically skilled, but pre-built tools enable automated large-scale attacks with very real consequences.
Hacktivists
Politically or socially motivated. Their goal is to disrupt systems or publish data in order to spread a message.
Attack Methods: How Cyberattacks Work
The first step of an attack is initial access-unauthorized entry into a system or network. Attackers often combine technical vulnerabilities with human factors.
Software Vulnerabilities
Flawed or misconfigured software creates entry points. Attackers systematically scan for known CVEs and zero-day vulnerabilities and develop targeted tools to exploit them.
Trojan Malware
Malware disguised as legitimate applications or documents grants attackers direct system access once installed—often also providing entry into internal corporate networks.
Botnets
Compromised devices automatically scan the internet for vulnerable systems or overwhelm targets with DDoS attacks, while masking the attackers’ identity.
Phishing & Spam
Deceptively authentic messages via email, SMS, phone, or QR code target login credentials and payment information, often combined with unpatched vulnerabilities.
Social Engineering
Manipulation of human emotions through impersonation, pretexting, baiting, or intimidation. This approach is often more effective than purely technical attacks.
Physical Access
Even brief physical access can have serious consequences: theft of devices, installation of keyloggers, or direct manipulation of IT hardware.
Modern attacks combine technical vulnerabilities with the human factor
Typical Impact of Successful Attacks
The immediate and long-term consequences vary significantly depending on the objective and the methods used.
Ransomware
Encryption of critical data followed by extortion. Even full ransom payment does not guarantee recovery. Backups are the most reliable safeguard.
Data Theft
Stolen data is used for extortion, identity fraud, or sold on criminal marketplaces. Long-term consequences include fines, loss of trust, and reputational damage.
Denial of Service
Overloading systems leads to outages and service disruptions. Prolonged interruptions damage business relationships and impact entire supply chains.
⚠️
Observe reporting obligations: Cyberattacks are criminal offenses. Under NIS 2, GDPR, or sector-specific regulations, organizations may be required to report serious security incidents and preserve evidence.
