Major Cyberattacks of 2024–2025: Timeline, Impact & Lessons Learned

Introduction

2024 and early 2025 have witnessed some of the most devastating cyberattacks in history. Total global cybercrime costs are projected to reach $10.5 trillion annually by 2025 (Cybersecurity Ventures). This deep-dive analyzes the major incidents, their root causes, and actionable lessons for defenders.

The Common Thread: Nearly every major breach in 2024 could have been prevented by enforcing multi-factor authentication. MFA is no longer optional — it is the single most impactful security control.

---

Attack Timeline & Key Statistics

2024–2025 By The Numbers

---

Major Incidents

Pattern Alert: 4 out of 6 major incidents below involved missing MFA as a contributing factor.

1. Change Healthcare Ransomware (Feb 2024)

Attack Type: Ransomware (ALPHV/BlackCat) Impact: $872 million in damages; 100M+ patient records compromised Attack Vector: Stolen credentials for a Citrix remote access portal without MFA

What Happened:

• Attackers used stolen credentials to access Change Healthcare's Citrix portal
• No multi-factor authentication was enabled on the portal
• ALPHV ransomware was deployed, encrypting critical healthcare systems
• UnitedHealth Group paid a $22 million ransom
• Attackers still leaked data; an affiliate demanded a second ransom

Key Lessons:

1. MFA is non-negotiable for all remote access
2. Network segmentation could have limited the blast radius
3. Healthcare organizations must prioritize cybersecurity investment
4. Paying ransoms doesn't guarantee data safety

---

2. Snowflake Customer Data Theft (May–June 2024)

Attack Type: Credential stuffing / Data exfiltration Impact: 560M+ records across 165+ companies (Ticketmaster, AT&T, Santander) Attack Vector: Compromised credentials without MFA, stolen via infostealer malware

What Happened:

• Threat group UNC5537 used credentials stolen by infostealers (Vidar, RedLine)
• Targeted Snowflake customer accounts that lacked MFA
• Exfiltrated massive datasets from Ticketmaster (560M records), AT&T, Santander, and 160+ other companies
• Attempted to sell data on dark web; demanded extortion payments

Key Lessons:

1. Enforce MFA on all SaaS platforms
2. Monitor for infostealer infections on corporate devices
3. Implement IP allowlisting for data platform access
4. Use network tokens and session management

---

3. MOVEit Transfer Aftermath & Cl0p Campaigns (2023–2024)

Attack Type: Zero-day exploitation (SQL injection CVE-2023-34362) Ongoing Impact: 2,700+ organizations; 95M+ individuals affected Cost: Estimated $12 billion in total damages

What Happened:

• Cl0p ransomware group exploited a zero-day SQL injection in MOVEit Transfer
• Mass exploitation affected government agencies, banks, universities, airlines
• Throughout 2024, stolen data continued to surface on dark web
• Copycat attacks against other file transfer solutions (GoAnywhere, Accellion)

Key Lessons:

1. File transfer solutions are high-value targets — audit them regularly
2. Zero-day vulnerabilities require defense-in-depth strategies
3. Segment file transfer systems from core networks
4. Monitor for anomalous data exfiltration patterns

---

4. Microsoft Executive Email Compromise (Jan 2024)

Attack Type: Password spraying + OAuth token theft (Midnight Blizzard / APT29) Impact: Email accounts of senior leadership and cybersecurity teams accessed Attack Vector: Password spray on legacy test tenant → OAuth app abuse

What Happened:

• Russian state-sponsored group (Midnight Blizzard) password-sprayed a legacy test tenant
• Gained access to an OAuth application with elevated permissions
• Pivoted to read email of C-suite and security team members
• Microsoft disclosed the breach publicly in January 2024

Key Lessons:

1. Decommission legacy/test accounts and tenants
2. Audit OAuth application permissions regularly
3. Nation-state actors target security teams specifically
4. Even tech giants are vulnerable

---

5. National Public Data Breach (Aug 2024)

Attack Type: Data breach / unauthorized access Impact: 2.9 billion records; SSNs, names, addresses exposed Attack Vector: Unknown initial access; data sold on dark web for $3.5M

What Happened:

• Background check company National Public Data was breached
• Hackers claimed to have 2.9 billion records
• Data included Social Security numbers, full names, addresses dating back 30 years
• Company faced multiple class-action lawsuits and eventually filed for bankruptcy

Key Lessons:

1. Data aggregators are critical supply chain risk
2. Minimize data collection and retention
3. Encrypt all PII at rest and in transit
4. Third-party risk management is essential

---

6. AI-Powered Deepfake Fraud (Feb 2024)

Attack Type: Business Email Compromise via AI deepfake Impact: $25.6 million stolen from a Hong Kong finance firm Attack Vector: Deepfake video call impersonating CFO and executives

What Happened:

• Attackers used AI-generated deepfake video and voice
• Conducted a video conference call impersonating the company's CFO
• Employee was convinced to transfer $25.6 million across 15 transactions
• Entirely AI-driven social engineering — no malware involved

Key Lessons:

1. AI-powered attacks are now operationally viable
2. Implement multi-person authorization for large transfers
3. Use code words or out-of-band verification
4. Train employees on deepfake awareness

---

Industry Impact Analysis

Most Targeted Sectors & Breach Costs (2024)

---

Defensive Recommendations

Immediate Actions

1. Enforce MFA everywhere — 2024 breaches overwhelmingly exploited missing MFA
2. Audit third-party access — SaaS platforms, file transfers, OAuth apps
3. Patch critical vulnerabilities within 48 hours — Especially internet-facing systems
4. Implement EDR — Detect infostealer malware before credentials are stolen
5. Test incident response plans — Tabletop exercises quarterly

Strategic Investments

1. Zero Trust Architecture — Identity-centric security model
2. AI/ML threat detection — Counter AI-powered attacks
3. Supply chain security program — SBOM, vendor assessments
4. Continuous security validation — Breach & attack simulation
5. Cyber insurance — Ensure adequate coverage for ransomware scenarios

---

Conclusion

The attacks of 2024–2025 share common themes: missing MFA, excessive permissions, unpatched systems, and inadequate monitoring. Organizations that implement basic security hygiene — particularly MFA, least privilege, and rapid patching — can prevent the vast majority of breaches.

Related Resources on SecureCodeReviews:

• Vulnerability Dashboard — Track vulnerability trends with interactive charts
• OWASP Top 10 — Understand the most critical web application risks
• Cloud Security Guide — Secure your cloud infrastructure
• Free Security Tools — Test your security posture today