As part of its annual Kaspersky Security Bulletin, the company’s experts have analysed significant supply chain attacks and IT outages from the past year and explored potential future risk scenarios, providing insights aimed at helping businesses of all sizes enhance cybersecurity, build resilience, and prepare for possible emerging threats in 2025.

In 2024, supply chain attacks and IT outages emerged as dominant cybersecurity concerns, demonstrating that virtually no infrastructure is immune to risk.

A faulty CrowdStrike update affected millions of systems, and sophisticated incidents, such as the XZ backdoor and the Polyfill.io supply chain attack exposed the risks inherent in widely used tools.

These and other high-profile cases highlight the need for rigorous security measures, robust patch and update management, and proactive defenses to safeguard global supply chains and infrastructure.

In its “Story of the Year”, the Kaspersky Security Bulletin reflects on 2024’s past incidents, while contemplating hypothetical future scenarios, and considering their potential consequences, as follows:

What if a major AI provider faced an outage or a data breach? Businesses are increasingly relying on various models such as those from OpenAI, Meta, Anthropic and others.

However, despite the excellent user experience these integrations offer, they introduce significant cyber risks. Reliance on a single or limited number of AI service providers creates concentrated points of failure.

If a major AI company experiences a critical disruption, it could significantly impact dozens or even thousands of services that depend on them.

Furthermore, an incident at any major AI provider could result in one of the most severe data leaks, as these systems may store vast amounts of sensitive information.

What if on-device AI tools were exploited? As AI becomes more integrated into everyday devices, the risk of it becoming an attack vector grows significantly.

For instance, the Operation Triangulation campaign, uncovered by Kaspersky in 2023, demonstrated how attackers could compromise device integrity by exploiting zero-day vulnerabilities in the system software and hardware to deploy advanced spyware.

Similar potential software or hardware-assisted vulnerabilities in the neural processing units powering AI – both broadly and in specific platforms like Apple Intelligence – could, if discovered, extend or present an even greater threat. Exploiting such weaknesses could harness AI capabilities to significantly amplify the scope and impact of such attacks.

Kaspersky’s research into Operation Triangulation also revealed the first of its kind case reported by the company: the misuse of on-device machine learning for data extraction, highlighting that the features designed to enhance user experience are already being weaponised by sophisticated threat actors.

What if threat actors disrupted satellite connectivity? While the space industry in general has been encountering various cyberattacks for a while, the new target for threat actors may be satellite Internet providers as important elements of the global connectivity chain.

Satellite Internet can provide temporary communication links when other systems are down; airlines, ships, and other platforms may rely on it to provide onboard connectivity; it may also be used to enable secure communication services.

This presents cyber risks: a targeted cyberattack or a faulty update from a leading or dominant satellite provider could cause Internet outages and potential communication breakdowns, impacting individuals and organisations.

What if major physical threats to the Internet occurred? Continuing the topic of connectivity, the Internet is also vulnerable to physical threats. 95% of global data is transmitted through subsea cables, and there are nearly 1,500 Internet Exchange Points (IXPs) – physical locations, sometimes within data centers, where different networks exchange traffic.

A disruption to just a few critical components of this chain – such as key cables or IXPs – could overload the remaining infrastructure, potentially causing widespread outages and significantly impacting global connectivity.

What if severe vulnerabilities in Windows and Linux kernel were exploited? These operating systems power many of the world’s critical assets, including servers, manufacturing equipment, logistics systems, IoT devices, and others.

A remotely exploitable kernel vulnerability in these systems could expose countless devices and networks worldwide to potential attacks, creating a high-risk situation in which global supply chains could face significant disruption.

“Supply chain risks may seem overwhelming, but awareness is the first step toward prevention,” said Igor Kuznetsov, Director of Global Research and Analysis Team (GReAT) at Kaspersky.

“By testing updates rigorously, leveraging AI-driven anomaly detection, and diversifying providers to reduce single points of failure, we can reduce weak elements and build resilience. A culture of responsibility among personnel is equally vital, as human vigilance remains the cornerstone of security. Together, these measures can safeguard supply chains and ensure a more secure future”.

Microsoft has announced plans to invest $80 billion in the 2025 fiscal year to expand its data centre infrastructure.

The investment will focus on supporting the training of artificial intelligence (AI) models and the deployment of AI and cloud-based applications.

The company disclosed this initiative in a blog post on Friday, emphasising its commitment to advancing AI and cloud technology.

Since OpenAI launched ChatGPT in 2022, investment in AI has surged as businesses across sectors strive to integrate artificial intelligence into their products and services.

AI requires enormous computing power, pushing demand for specialised data centres that enable tech companies to link thousands of chips together in clusters.

Before now, Microsoft has invested billions of dollars to enhance its AI infrastructure, broadening its data centre network.

Analysts project Microsoft’s fiscal 2025 capital expenditure, including capital leases, to reach $84.24 billion, according to Visible Alpha.

The company’s capital expenditure in the first quarter of the fiscal year rose by 5.3% to $20 billion.

As the primary backer of OpenAI, the tech giant is considered a leading player among Big Tech companies in the AI race, owing to its exclusive partnership with the AI chatbot developer.

More than half of Microsoft’s $80 billion investment will be allocated to the United States, Brad Smith, vice chair and president noted in the blog post.

“Today, the United States leads the global AI race due to the investment of private capital and innovations by American companies of all sizes, from dynamic start-ups to well-established enterprises,” Smith remarked.

Nigeria Data Protection Commission (NDPC) has announced plans to significantly ramp up enforcement and impose substantial fines on data controllers and processors that violate the Nigeria Data Protection Act (NDPA) of 2023.

Vincent Olatunji, national commissioner/CEO. NDPC

This was disclosed by Dr Vincent Olatunji, national commissioner/CEO of the Commission, in a video message outlining the Commission’s 2025 agenda, shared on the agency’s social media platforms.

A statement issued by the Communications Division of the Commission on Friday quoted Dr Olatunji as saying that, “For data controllers and processors, there is going to be massive enforcement. We have never really issued any fine, but going forward, you’ll hear us giving heavy penalties.”

He assured Nigerians that their data rights, as guaranteed by the NDPA, will be fully protected, and defaulting data controllers and processors will face strict consequences.

The Commissioner highlighted the NDPC’s extensive engagements with stakeholders across public and private sectors to promote awareness and compliance with the Commission’s mandate.

The efforts, he said, have resulted in the signing of Memorandums of Understanding (MOUs) with key organisations, including the National Insurance Commission (NAICOM), National Lottery Regulatory Commission (NLRC), the Data Privacy Office of Canada, and the Dubai International Financial Centre Authority (DIFC), among others.

Dr Olatunji also shared that the NDPC will advance to the second phase of its Strategic Roadmap and Action Plan (NDP-SRAP 2023-2027) in 2025.

This phase is expected to create job opportunities within Nigeria’s data protection and privacy ecosystem, particularly for young people.

The Commission has been actively training Nigerians in data protection and privacy, creating a pool of globally competitive experts within the data protection sector in 2025.

“There are a lot of data controllers and processors that are looking for people to work with them. Now those that we have trained in 2024, those we have certified, we are going to do more this year to actually launch them to the job market where they can really work with data controllers and processors,” he said.

Additionally, the NDPC will continue nationwide efforts to promote data protection awareness.

The Commission aims to educate citizens about their rights and the importance of data privacy while reminding data controllers and processors of their obligations under the NDP Act.

Dr Olatunji emphasised that these initiatives are part of the broader goal to embed a culture of data protection and privacy in Nigeria.

As part of its international engagement efforts, Nigeria will host the “Network of African Data Protection Authorities Conference” in May 2025, with over 40 nations with existing data protection laws expected to attend.

According to Dr Olatunji, this global event will position Nigeria as a leader in the data protection ecosystem, and bring significant economic benefits to the country.

The NDPC reiterated its commitment to ensuring data protection and privacy become integral to Nigeria’s digital landscape, building trust and fostering economic growth, the statement added.