The Ten Costliest Cyber Crimes Of All Time

Yahoo, eBay, Amazon – $1.2 billion

Yahoo, eBay, Amazon – $1.2 billion As in the case of the recent Twitter/Facebook shutdown, a Denial of Service shut down 5 of the most popular websites in February 2000 for several hours. Flooding servers with paralyzing amounts of network data, hackers’ programs brought Yahoo, eBay and Amazon to a crawl and eventually crashed their systems. Although no financial gain was intended in the attack, market researchers at Yankee Group estimate the crash caused a capitalization loss of $1.2 billion. But for any eBay member bidding on a Jabba figurine at the time of the crash, the loss is beyond price.

Société Générale – $7.2 billion

Since the inception of the computer, there have been a lot of feathers in hackers’ caps — an AOL password here, a credit card number there — but single-handedly costing a French bank $7.2 billion and bringing down stock markets throughout Europe is something very few can say they achieved. French software developer and trader Jérôme Kerviel used his coworker’s accounts to generate risky trades in the derivatives market with funds from Société Générale and turned off signals which warned the bank of the trading patterns. European markets were hit with losses of about 6% and Kerviel was credited with the largest fraudulent trading loss in history.

Melissa virus – $80 million

Occasionally, cyber crime isn’t a calculated effort. Some hackers just want to unleash a malicious program or code string and watch the mayhem spread across affected machines. New Jersey resident David Smith was one such hacker, having created the Melissa virus in 1999 which led to $80 million in damage — according to trial estimates — and a 20 month prison conviction. The virus — supposedly named after a Florida stripper Smith knew — was sent via email attachment and was most devastating to businesses and servers dealing with bulk email. And you thought spam was a problem.

ILOVEYOU virus – $8.7 billion

Sandwiched between the Melissa virus and Code Red worm, the ILOVEYOU virus can claim the costliest damage of the 3. Like Melissa, ILOVEYOU was proliferated as an email attachment and was sent to approximately 84 million recipients. Those who knew better than to open a .VBS file were spared the infection, but — according to Sam Bhavnani of Computer Economics — between 2.5 to 3 million users weren’t so lucky. In their defense, few can resist the temptation of opening an email with the subject heading “I LOVE YOU.” Bhavnani estimated worldwide damage totaled $8.7 billion.

Code Red worm – $2.6 billion

Named after the Mountain Dew brand as well as its references to China (“Hacked By Chinese!”), the Code Red worm shook computer systems worldwide to their very motherboards. The program exploited vulnerable web servers and IP addresses by buffer overflow — overloading the memory and subsequently crashing the systems. Internet research company Computer Economics determined Code Red caused $1.5 billion worth of damage through down system time and loss of productivity, plus an additional $1.1 billion in inspection and patch distribution — totaling $2.6 billion.

Heartland Payment Systems – $12.6 million

Any security breach risks the loss of important company information, but when that company is the sixth largest credit card processor in the country, every person who used plastic at a restaurant or mall could find their account drained and their identity stolen. In January 2009, Heartland Payment Systems confirmed that hackers broke into their system which holds records of 100 million transactions per month for 175,000 merchants. In May, CEO Robert O. Carr estimated a loss of $12.6 million in legal fees, security cleanup and fines from MasterCard and Visa.

U.S. Department of Veteran Affairs – $20 million

As if veterans don’t have enough to worry about with pension cuts and medical benefits, a thoughtless blunder compromised the identities of 26.5 million veterans and troops in active duty. A data analyst from the federal department took home a laptop and external drive without permission, violating agency policy. The employee’s home was burgled and, alas, the laptop and drive vanished. Containing names, Social Security numbers and birth dates, the missing equipment led to a class-action lawsuit against the department for $20 million. Who fronted the bill? The U.S. Treasury.

ChoicePoint – $26.5 million

What’s worse: The security breach to a private intelligence service which held over 17 billion records of businesses and individuals, or the fact that the company neglected to notify the people whose files were leaked until 7 months later? ChoicePoint’s crack internal IT protection was seemingly no match for a team of Nigerian scammers who posed as legitimate businesses — with previous stolen identities, no less — to gain access to ChoicePoint’s accounts. With a fine by Federal Trade Commission and compensation to those affected, losses reached $26.5 million.

T.J. Maxx, Marshalls – $300+ million

Although the total cost of damage done by a computer virus is difficult to pin down, the largest customer data breach in history also puts final losses in a gray area. TJX Companies Inc — the parent company to T.J. Maxx and Marshalls — was slammed for over a year by a hacker who used a decryption tool to gain access to roughly 45.7 million credit and debit card accounts. TJX spokeswoman related to The Boston Globe in August 2007 that incurred costs have reached $256 million, but ongoing investigations and claims — including the $40.9 million to Visa and the $9.75 million to 41 states — place total loss over $300 million.

Conficker worm – $9.1 billion

Take this one with a grain of salt as the figure is disputed in some circles, but few can deny the devastating effect that the Conficker worm had on computer systems in late 2008. The Conficker worm was particularly devastating to networks due to its many variations, making it more difficult to eradicate and even active in some systems today. The most recent affection rate estimate puts the total to 3.5 million hosts. Conficker is purported to have caused $9.1 billion — according to the Cyber Secure Institute. Although a dubious figure, given that the virus is still making the rounds, it’s not out of the realm of possibility.