Think like a hacker, act like a professional

The data of 1.2 million Latvian residents ended up in the hands of cyberattackers after a recent attack on a state information system. The incident has renewed attention on how criminals collect personal information, prepare attacks and persuade people to open the door themselves.

One common method begins with a fake website designed to look like an online store. Visitors are encouraged to register and enter personal details. Attackers then gather email addresses, telephone numbers and other information, build databases and sell them to partners. Those databases can support automated calling campaigns aimed at stealing money, login credentials or other sensitive information.

Attackers do not always need to know who is waiting for a delivery on a particular day. A large database and the right timing may be enough. A fraudulent text message sent to thousands of people can appear convincing to anyone who happens to be expecting a package. The chance that the message arrives at a relevant moment helps make the scheme effective.

The focus of phishing is often less about sophisticated technology than psychology. Social engineering seeks to catch people when they are busy or tired, making them less likely to check an address, link or language error. Messages sent late in the evening can exploit declining concentration, while a sense of urgency can prompt people to approve requests automatically.

The time needed to plan an attack varies. Operations targeting critical infrastructure, including water and electricity companies, financial institutions and medical facilities, may involve planning, development and intrusion phases lasting more than a year. Simpler, commercially motivated hacking attempts may take only a few hours when criminals identify a weakness in a system, software or network. If vulnerabilities are fixed or exploitation offers no benefit, attackers may decide their resources are better used elsewhere.