Experts warn of escalating threats across European sports and travel sectors

Security experts caution about a sharp increase in cyber-attacks targeting European sports websites and travel sectors, citing a 59% surge in January followed by a further 66% rise in March. Erez Hasson, Application Security Expert at Imperva, predicts continued escalation through the summer, coinciding with major events like the UEFA EURO 2024 and Paris Olympic Games, underscoring the urgent need for enhanced protective measures.

Imperva's Advanced Bot Protection system reports successfully mitigating sophisticated bot attacks aimed at ticket scalping, account takeovers, and other forms of exploitation. Bots, often seen as mere nuisances, pose direct threats to the integrity of events and the safety of fans' personal information. Their use spans various malicious activities, including ticket scalping—a common issue during high-demand events. For instance, UEFA received over 20 million ticket requests for the 2.7 million tickets available for the EURO 2024 games, while nearly 8 million tickets have already been sold for the Paris Olympic Games in 2024. Bots buy large quantities of tickets, depriving genuine fans and then reselling them at inflated prices.

Account takeover is another significant issue, where bots use techniques like credential stuffing and cracking to hijack user accounts on sports websites. Attackers then exploit these accounts for fraudulent activities, including purchasing tickets and stealing personal information. Similarly, betting bots undermine bookmakers by scraping odds from multiple sports betting websites and placing arbitrage bets, leading to financial losses for legitimate users and market manipulation.

Meanwhile, Total Fitness, a UK health club and gym chain, recently faced criticism for failing to secure a database containing members' personal data. Jeremiah Fowler, a researcher, revealed that the database, which included 474,000 images of members and staff, along with documents revealing bank and payment information, was left unprotected and publicly accessible. This incident highlights the ongoing issue of cyber hygiene in organisations.

According to Chris Denbigh-White, Chief Security Officer at Next DLP, the failure to implement basic security controls remains a common issue in cybersecurity. He emphasises the importance of protecting sensitive data and adhering to regulations like the European Union's General Data Protection Regulation (GDPR). The ramifications of such a breach are far-reaching, potentially leading to identity theft and financial fraud. Denbigh-White calls for organisations to prioritise implementing fundamental security controls effectively.

Shobhit Gautam, Staff Solutions Architect at HackerOne, adds that sectors without stringent compliance standards, like gyms, often lack adequate security measures. He advises that organisations should classify and encrypt collected data to minimise risks. Vulnerability disclosure programmes can empower organisations by involving ethical hackers to identify and report vulnerabilities, including exposed databases before criminals exploit them.

Jerome Brock, Vice President of IT and Security at Censys, underlined the consequences of unprotected databases, from eroding trust to causing financial loss. He suggests proactive measures such as regular security assessments and anomaly detection to mitigate these risks. By maintaining a comprehensive view of the attack surface, organisations can be better prepared to manage their network and cloud services securely.

The hospitality and travel sectors are also experiencing a rise in targeted scams. Marine Wilkin, Booking.com's Chief Information Security Officer, reported a 900% increase in travel scams. Aaron Walton, Threat Intel Analyst at Expel, points out that campaigns targeting administrative credentials for Booking.com have been observed for the past 18 months. Phishing emails and fraudulent websites are used to steal credentials, which are then used to deceive travellers into making payments. Walton stresses that technology and collaboration are essential in combating these sophisticated scams beyond measures like multi-factor authentication (MFA).

These cases illustrate the broad and evolving nature of cyber threats across different sectors, highlighting the need for robust security measures and collaboration to protect against increasingly sophisticated attacks.