While some hackers have become rich by stealing millions of credit cards from Target, there are others who are trying more subtle methods to make easy money.
Online blackmail a spreading fad
In recent weeks, the two companies have publicly described their experiences with what is becoming a new popular tactic among hackers: cyber extortion. Cybercriminals threaten to reveal sensitive data or destroy websites and services unless a sum of money is paid.
Just like kidnappers, cybercriminals demand ransoms, and we've heard of cases like this before. But everything suggests that cyber extortion cases have increased significantly in recent months, with high-profile victims, according to Matthew Prince, CEO of CloudFlare.
“The audacity of the attacks has increased and they are being targeted everywhere without discrimination,” Matthew Prince said in an interview.
Last month, an unknown hacker threatened to destroy the website of Meetup, a social networking site with 16 million members, unless the company paid $300 in ransom.
On Monday, Basecamp, a software development company, received an email from a hacker who threatened to destroy the website and demanded payment in Bitcoin.
Both companies refused to pay. In response, the hackers took down Basecamp's website for two hours and Meetup's website for 24 hours.
These were just two isolated incidents of cyberbullying that occur online. There are no statistics showing the frequency of incidents because many companies will never admit it publicly.
Scott Heifernan, co-founder of Meetup, said his company “made the decision not to negotiate with the criminals,” in part because paying even the paltry sum of $300 could make the company a target for further extortion demands.
“We believe this small amount was a ploy to see if we would pay,” Heifernan said in a recent blog post. “If we did pay, the criminals would simply demand much more.”
Meetup may not have succumbed to the blackmail, but there are plenty of companies that do and keep it a secret. Hackers extort more than $5 million from their victims every year, according to security firm Symantec.
Matthew Prince said his company gets requests “every other day” from victims who need online protection because someone is threatening to take down their websites if they don’t pay. CloudFlare’s service acts as a shield, deflecting malicious traffic from bots while allowing legitimate visitors to access the site.
In most cases of cyber extortion, victims' websites go down for about 15 minutes. Then, their site comes back up, accompanied by an email from the hacker demanding a sum of money to stop the attack.
“Often, hackers present themselves as ‘white hat’ security researchers who discovered a flaw in the victims’ website,” said James Aquilina, a former federal cybercrime prosecutor.
“They will ask for, ‘$50,000, to help fix the security hole,’” Aquilina said.
Some cybercriminals use tools specifically designed for extortion. Last year, a Symantec report highlighted the growing use of “ransomware,” which can disable individual or corporate systems until someone pays the hacker. Only about 3 percent of victims pay the ransom, but the scam is quite profitable because hackers have infected thousands of computers with ransomware, according to Symantec.
“They are essentially holding your data hostage,” Prince said.
Symantec knows firsthand what it's like to face cyber extortion. In 2012, the company said that a group of hackers from Anonymous began releasing the source code for one of its products. The hackers then said they would stop if the company paid them $50,000 .
Some criminals are greedy enough to demand much more than that. In 2012, a hacker from Hungary was sentenced to 30 months in prison for stealing data from Marriott computers. After the hack, he threatened to reveal the data he had taken from the company if the hotel chain didn't offer him a $150,000-a-year job, free airfare, and hotel rooms of his choice.
