In this assignment, you will choose and examine a significant cybercrime/cyberattack/data breach that interests you. “Significant” means that the breach was serious enough to warrant attention by the news media and has provided enough coverage in news, trade, and scholarly literature to allow you to find sufficient research for this assignment.

You will review information on the attack and produce a case study that summarizes the events and impacts.

Step 1

• Choose a significant cybercrime/cyberattack/data breach

Step 2

• Conduct research
  • Explore 3–5 websites to examine different perspectives about the breach you have chosen. Refrain from relying on blogs as sources. To find credible sources, you might begin with the UMGC Library using OneSearch, Google Scholar, or web search (Google), government websites, and professional organizations.

Step 3

• After reviewing the information on your chosen cybercrime/cyberattack, write a case study to summarize the case.
• The case study should be written in paragraphs so that points have elaboration and connections that make it easy to understand the case.
• For your case study, follow these steps:
  • Begin with information about the victim, which will be a company, organization, agency or person.
  • Include discussion of information about the victim to give context to the event. For example, if the victim is a company, then include its work, mission, location and other relevant points. If the victim is a person, report enough information so that the reader can understand the individual and the situation.
  • Provide a brief overview of the attack.
  • Create a timeline of the cybercrime or attack (details will vary based on how much information is shared in published documents). Be sure the timeline accounts for when the attack began, when it ended, and what happened between those times. The timeline format can be presented in chronological order with bullet points. The timeline can be presented in past-to-present format or present-to-past, if you are consistent.
  • Identify the reported risks and/or vulnerabilities that made the attack possible. Consider why the attack happened to the company or person.
  • Discuss the costs and/or damages from the attack. Costs can include finances, reputation, customers, and other types of impacts.
  • Report the prevention measures stated by cybersecurity practitioners. Summarize what was learned from the event in a way that could help limit future victimization.
  • Identify any factors that were not discussed but that you believe could impact future cybercrimes. Consider risk factors and aspects that create vulnerabilities.

How to Write a Cybercrime Case Study on a Significant Cyberattack or Data Breach

Introduction

Introduce the purpose of the case study by explaining that cybercrime, cyberattacks, and data breaches can create substantial financial, operational, legal, reputational, and security consequences for organizations and individuals. State that the assignment requires selecting a significant cyber incident with sufficient credible documentation to support an evidence-based analysis. Identify the selected incident and briefly explain why it represents an important cybersecurity case. Establish that the case study will examine the victim, circumstances surrounding the attack, chronology of events, vulnerabilities, consequences, prevention measures, and additional factors that may influence future cybercrime.

Section 1: Identify and Introduce the Victim

Begin by identifying the organization, agency, company, or individual targeted by the cyberattack. Provide relevant background information that allows the reader to understand the victim’s importance and exposure to cybersecurity threats. For a company, discuss its industry, products or services, approximate size, geographic presence, customers, and the type of information or systems it manages. Explain why the organization may have represented an attractive target for cybercriminals and connect these characteristics to the potential consequences of a successful attack.

Section 2: Provide an Overview of the Cyberattack

Provide a concise but informative overview of what happened. Identify the type of cybercrime involved, such as ransomware, phishing, credential theft, malware, supply-chain compromise, distributed denial-of-service attack, insider threat, or data breach. Explain how attackers gained access, what systems or information were affected, and what the attackers attempted to accomplish. Distinguish clearly between confirmed facts and information that was alleged, suspected, or subsequently determined by investigators.

Use multiple credible sources to compare perspectives about the attack. Government agencies, law-enforcement agencies, cybersecurity organizations, reputable news organizations, company reports, regulatory filings, and scholarly publications should be prioritized over blogs or unsupported online commentary.

Section 3: Create a Chronological Timeline of the Attack

Create a timeline showing the progression of the cyber incident from its initial compromise through detection, containment, investigation, recovery, and subsequent developments. The timeline should identify when the attack began if that information is known, when suspicious activity was discovered, when the organization responded, when affected systems were restored, and when customers, regulators, law enforcement, or the public were notified.

Although the final paper should primarily be written in paragraphs, the assignment specifically permits the timeline to be presented chronologically using bullet points. Make sure each timeline entry contains a date or approximate period and a concise description of what occurred. Explain the significance of the major events surrounding the attack rather than simply listing dates.

Section 4: Identify Risks and Vulnerabilities

Analyze the vulnerabilities that allowed the cyberattack to occur. Discuss technical weaknesses such as unpatched software, compromised credentials, inadequate authentication, exposed systems, insecure configurations, insufficient network segmentation, vulnerable third-party connections, or inadequate monitoring when supported by evidence. Also consider human and organizational factors, including phishing susceptibility, insufficient cybersecurity training, weak policies, inadequate incident-response planning, or ineffective access controls.

Explain why the attackers may have targeted the victim. Consider the value of financial information, personally identifiable information, healthcare information, intellectual property, operational systems, customer databases, or other valuable assets. Connect the identified vulnerabilities to established cybersecurity principles such as confidentiality, integrity, availability, least privilege, defense in depth, and risk management.

Section 5: Discuss the Costs and Damages

Analyze the consequences of the attack from multiple perspectives. Discuss direct financial costs such as ransom payments when applicable, investigation expenses, system restoration, cybersecurity improvements, legal expenses, regulatory penalties, notification costs, and lost revenue. Explain that indirect costs can be equally significant, including operational disruption, employee productivity losses, customer dissatisfaction, loss of trust, reputational damage, and potential loss of business.

Discuss the impact on individuals if personal or sensitive information was exposed. Consider risks such as identity theft, fraud, phishing, account compromise, privacy violations, or long-term exposure of personal information. Support financial and impact claims with credible sources and distinguish between confirmed losses and estimated damages.

Section 6: Prevention and Lessons Learned

Discuss the cybersecurity measures recommended or implemented following the attack. These may include multifactor authentication, stronger identity and access management, network segmentation, vulnerability management, endpoint detection and response, encryption, security awareness training, improved logging and monitoring, regular backups, zero-trust principles, vendor-risk management, and formal incident-response planning.

Explain how the lessons from the selected incident can be applied to other organizations. Connect specific vulnerabilities to specific preventive controls rather than simply listing general cybersecurity recommendations. For example, if compromised credentials contributed to the attack, explain how multifactor authentication and privileged-access management could reduce similar risks. If a third-party supplier was involved, discuss the importance of supply-chain risk assessments and contractual cybersecurity requirements.

Section 7: Identify Additional Factors Affecting Future Cybercrime

Go beyond what the published sources explicitly identify and provide your own evidence-based analysis of factors that could contribute to future attacks. Consider emerging technologies, artificial intelligence, increasingly sophisticated social engineering, cloud environments, remote work, interconnected systems, supply-chain dependencies, cryptocurrency-based extortion, and the expanding availability of criminal hacking tools.

Discuss how organizational culture and cybersecurity governance may influence future vulnerability. Explain that cybersecurity cannot be treated solely as an information-technology responsibility because executive leadership, employees, vendors, legal teams, risk managers, and other stakeholders influence an organization’s security posture. Conclude this section by identifying the most important lessons organizations should take from the selected incident.

Section 8: Research and Source Integration

Use approximately three to five credible sources to develop the case study, while adding additional scholarly or authoritative sources if necessary to provide adequate evidence. Prioritize government agencies, cybersecurity organizations, professional organizations, regulatory filings, reputable news organizations, academic journals, and official statements from the affected organization. Avoid relying on blogs as primary evidence, particularly when making claims about the attack timeline, attribution, financial damages, or security vulnerabilities.

Compare information across sources because accounts of major cyberattacks may change as investigations develop. When sources disagree, acknowledge the disagreement rather than presenting uncertain information as fact. Use APA-style in-text citations throughout the case study and ensure that every source cited in the paper appears in the reference list.

Conclusion

Conclude by synthesizing what the selected cyberattack demonstrates about modern cybersecurity risks. Summarize the victim’s exposure, the major events in the attack, the vulnerabilities that enabled the incident, and the resulting financial, operational, and reputational consequences. Reinforce the importance of applying lessons learned through stronger technical controls, employee awareness, cybersecurity governance, incident-response planning, and continuous risk assessment. End by explaining how the case can help organizations recognize and mitigate similar threats before they develop into significant cyber incidents.

References

Include all sources cited in the case study in APA 7th edition format and arrange them alphabetically by the author’s last name or the responsible organization’s name. Government reports, professional cybersecurity organizations, scholarly publications, reputable news sources, and official organizational reports should be prioritized. Ensure that each reference contains sufficient publication information and a DOI or URL when applicable.

Last Completed Projects