Imagine, you are in the middle of a heated battle and are almost ready to claim the victory over your virtual opponent when you see a note on the screen: “We are experiencing a DDoS attack which may result in disconnections for some players.” Now?
Cyber attacks like that happen to video gaming companies quite regularly in the last couple of years. Players can lose access to their device or game data, their profile can be wiped out, or their financial data can be stolen. ComputerWeekly reported that the video game industry also suffered nearly 11 billion credential stuffing attacks in 2020, marking a 224% increase over the previous year. The research conducted by The Harris Poll among 700 American gamers found that 47% of them experienced a cyber attack. 76% of those players were financially affected, losing on average $744.
So what made the industry so attractive to bad actors?
As a result of COVID-19 with stay-at-home restrictions, video gaming and gambling skyrocketed as a way to escape the reality, pass the time or connect with other players virtually. In 2020, the global online gaming market recorded a 21.9 percent growth compared to 2019, reaching $21.1B U.S. dollars in revenue. During the pandemic, 227 million Americans say they play video games.
While video gaming companies celebrated significant profits, cybercriminals noticed lucrative opportunities and became bolder in taking action.
3 Biggest Cybersecurity Threats for Video Gaming Companies
DDoS Attacks
If a couple of years ago Distributed Denial of Service attacks (DDoS) were just a nuisance for businesses, today they constitute serious, costly cybercrime. Criminals generate large volumes of packets or connection requests that cause the entire network or site to crash or slow down.
The downtime can cost victims $100K USD per hour, while hackers can do a lot of damage during that time, including stealing data, taking over players’ accounts, or committing other types of cybercrime.
Riot Games, Activision Blizzard, and Ubisoft have all been victims of disruptive DDoS attacks.
High-velocity Attacks
High-velocity attacks are any type of bot-driven attack in support of fraud, including BIN attacks, terminal attacks or brute force attacks such as credential stuffing and account compromise.
In 2022, video gaming companies, as well as other industries, face a revolution of intelligent bots. Arkose Labs reported in their 2022 State of Fraud & Account Security Report that in 2021, the complexity of bot detection increased by three times and that 86% of all attacks last year were automated attacks. Bots are so good at mimicking human behavior with the help of AI that they bypass even industry-leading solutions.
Account Takeovers
Account Takeover (ATO) attacks happen when cybercriminals gain player’s personal information, such as passwords or email addresses, to target their account. Once hackers successfully access the account they can change account details, withdraw earnings or bonus points, or make purchases online.
ATO attackers very often employ bots for gaining access to an account. Cybercriminals are using AI to make their attacks more sophisticated and elaborate. As a result, they can evade security solutions. If a gaming company has a data breach, it can lose its reputation and the loyalty of its players. Restoring lost trust is not easy.
In the beginning of 2022, Electronic Arts confirmed that cybercriminals used phishing and social engineering tactics to execute ATO attacks on high-profile FIFA Ultimate Team (FUT) gamers. The attacks were identified only when several accounts had been stripped of FIFA points and coins.
How Gaming Companies Can Protect Their Players and Profits
For video gaming companies, one of the best ways to improve defense against cyber threats is to develop a powerful cybersecurity strategy, combined with the right technology tools and proactive real-time monitoring for suspicious activity.
Here are three steps to improve your cyber defense:
1. Find Gaps and Weak Links in Cybersecurity
When planning an attack, cybercriminals look for vulnerability gaps in the gaming ecosystem. Do you collect all the data you need when analyzing threats? Is that data collection happen in real-time? Can your system compare users’ behavior with what is expected of them? Is the data readily available for an investigation?
If your team takes a holistic approach and looks at your ecosystem as a criminal, you might see that it’s not, for example, authentication the weakest link, it’s the quality of your incident data. If you spot those gaps, you will be able to fix them.
Learn More about Finding Weak Links in Your Security
2. Leverage New Technology
Traditional solutions, like web application firewalls (WAF) and Web application and API protection (WAAP), protect against attacks targeting the application layer. They block traffic at the network level (IP address and port). That means that they also block legitimate transactions (good players) coming through the same IP address and port. The impacts are lost revenue, brand damage, and angry players.
New solutions, like INETCO BullzAI® Cybersecurity for Enterprise, can automatically detect and surgically block application-layer attacks generated by today’s sophisticated DDoS, DDoS ransom, bot, velocity, and APT attacks. INETCO BullzAI does this at the message and message field level, without blocking legitimate online activity or adding latency. Losses are minimized, brand reputation is preserved, and user impact is limited.
3. Stay Prepared for New Risks
Cyber attacks are constantly evolving in their intelligence and complexity. If your cybersecurity solution only protects at the network layer or from specific types of attacks and doesn’t evolve, you might need to consider how to bolster your defenses.
Newer solutions are powered by machine learning with supervised and unsupervised models that can detect known and unknown attack patterns. They can self-learn and adjust their algorithms to spot anomalies on the fly, improving your resilience to future threats. More accurate detection also means that fewer legitimate players are blocked as you repel the cyberattack, reducing negative impacts on your gamers.
If you are a video gaming company ready to improve your resilience to cybercrime, talk to one of our cybersecurity experts.