- Pro
Why cyber criminals are getting younger, and what to do next
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Image credit: Shutterstock
(Image credit: Shutterstock)
Share
Share by:
- Copy link
- X
- Threads
17, 19 and 20. Those are the ages of the suspects in both the recent Kido nursery hack and the April attacks that left British retailers Marks & Spencer and The Co-operative with reduced services and millions of pounds down.
The same gang who claimed responsibility for the M&S hack also targeted Jaguar Land Rover in August, halting global production and affecting thousands of businesses who rely on sales to JLR to support their own employees.
Nick PalmerSocial Links NavigationHead of International Business Development and Sales of Group-IB.
In the past, such attacks on industry behemoths were largely carried out by state-sponsored hackers from nations such as Russia or North Korea. But the vast majority of suspects identified in recent high-profile cyberattacks have two things in common: they’re English-speaking, and they’re young.
You may like-
Human risk: don’t blame the victim, fix the system
-
Cyber resilience is a business imperative: skills and strategy must evolve
-
Prepared for a cyber attack? The three questions that businesses must ask themselves
At a time where our younger generations are facing a choice between using skills for good and bad – it’s critical we sway them towards careers in the cybersecurity industry.
Where are young people learning how to hack?
The sudden spike in youth cybercrime might indicate a rise in the number of young people learning how to hack - but there’s another reason: the growing accessibility of ransomware, peddled by an increasing number of Ransomware-as-a-Service (RaaS) suppliers.
RaaS groups supply the programs which affiliates (like the teens arrested in the M&S and Co-op hacks) then use to target specific businesses.
The affiliate programs make it easy for wannabe hackers to access the infrastructure needed to break through an organization's security measures - meaning they don’t have to be highly skilled hackers in their own right.
Are you a pro? Subscribe to our newsletterContact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsorsBy submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.In return for use of their platform, the RaaS group takes a cut of the earnings an attack generates from affected businesses. Most often this comes from a ransom, which is paid to recover the encryption key to decode stolen data and keep it from being published on the web.
What’s driving young people towards cybercrime?
So, hacking is getting more accessible. But why is it attracting an increasing number of young people?
Fergus Hay, co-founder of youth cyberskills initiative, The Hacking Games, recently spoke on Group-IB's Masked Actors podcast to the common motivations for young cyber criminals. He summarized these as - ‘The four Fs’: fame, frustration, finances and friends.
You may like-
Human risk: don’t blame the victim, fix the system
-
Cyber resilience is a business imperative: skills and strategy must evolve
-
Prepared for a cyber attack? The three questions that businesses must ask themselves
High-profile cyberattacks satisfy all of the above - they provide their perpetrators with recognition, with an outlet for growing dissatisfaction, and with a potentially very large payout from organizations who bend to the ransom demands.
As for the community aspect, Fergus suggests that this has its roots in online gaming communities - where many young people get their first taste of ‘hacking’. In games, you've got a live laboratory of testing, hacking, modding, breaking games, doxxing each other, and creating aim-bots.
All this experimentation is developing their skillset, and it's rewarded all the time with XP points and promotions and competitions.
In gaming communities, hacking is therefore not only encouraged but legitimized.
Another potential root cause lies in the way cyber talent has been historically sourced and developed. Traditional recruitment often focuses on formal education and training, whereas self-taught, gifted individuals who don’t follow this conventional path are overlooked.
Fergus also notes that an overwhelming majority of cyber talent are neurodiverse, which may make traditional recruitment paths even more inaccessible.
With legitimate career paths appearing out of reach, talented individuals with strong cyber skills - and knowledge of what those skills might earn them if put to use illegally – are prime targets for recruitment by cybercriminals organizations.
Ethical cybersecurity’s image problem
The cybersecurity skills gap is not a new issue. In September of this year, the UK Government released a study which showed that almost half of all UK businesses struggle with a ‘basic skills gap’.
The top three perceived skills gaps within the cyber sector were in ‘auditing and assurance’, ‘digital forensics’, and ‘cryptography and communications security’.
These are areas where young talent could thrive - and yet, while talent shortages have shrunk since last year, there’s still a long way to go.
One potential reason is the perception of cybersecurity roles amongst young people; they’re viewed as dull, or overly technical, lacking the allure and appeal of underground criminal work. Just compare the pop culture imagery of a mysterious, elite hacker to that of an IT professional haunting a corporate basement.
This image problem has real consequences. Without convincing incoming digital talent that cybersecurity is a viable, desirable career, the industry will continue to lose skills to more ‘thrilling’ environments.
Where do we go from here?
To combat the rise of youth cybercrime, the industry needs to do more than bolster security perimeters. It needs to address the social factors drawing young people towards criminality in the first place.
The image of cybersecurity needs to shift, to entice new talent towards legitimate career paths - but so does the image of a good hire.
Organizations must look at their hiring policies and redefine what a good hire looks like. It's time to rethink how the industry engages with potential talent, reaching them where they are spending their time - whether that’s in a gaming environment or on Discord servers.
And, we have to look beyond the traditionally accepted candidates to fill the skills gap, reaching those outside of the higher education system and in neurodiverse communities, with opportunities to develop skills and identify career paths.
Recent cases have overwhelmingly shown that young people in the UK and beyond have the cyberskills necessary to make a huge difference, whether as a liability or an asset. Now it’s down to the industry to show that there are legitimate spaces where their talent will be valued - before they go to the RaaS message boards.
You can listen to the full episode From Joysticks to Jailbreaks wherever you get your podcasts. Just look for ‘Masked Actors’.
We've featured the best encryption software.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
TOPICS AI Nick PalmerSocial Links NavigationHead of International Business Development and Sales of Group-IB.
Show More CommentsYou must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
Logout Read more
Human risk: don’t blame the victim, fix the system
Cyber resilience is a business imperative: skills and strategy must evolve
Prepared for a cyber attack? The three questions that businesses must ask themselves
Europe’s fall from cyber safety grace: why it is now among the world’s riskiest cyber regions
Supply chain cyberattacks are becoming unmanageable - and UK businesses are paying the price
Why our own clicks are often cybercrime's greatest allies
Latest in Pro
Cost of Bank of England's Oracle migration set to triple
North Korean hackers using malicious QR codes in spear phishing, FBI warns
TechRadar Pro, Residential Systems, and TWICE announce CES Picks 2026 winners
Record profits forecast for Samsung with dramatic increase in AI chip demand
IBM's AI 'Bob' could be manipulated to download and execute malware
10 emergency directives retired as CISA declares them redundant
Latest in Opinion
Why are cybercriminals getting younger?
Why I won't use ChatGPT Health
Forget fitness trackers — external brains are the hot new wearables at CES this year
I just traded in my Polar running watch for a Garmin after learning a rather expensive lesson
Samsung just won CES 2026 with its creaseless folding OLED – but I hope the iPhone Fold gets it first
AI factories are the foundation for enterprise-scale AI
LATEST ARTICLES- 1I used Meta’s Neural Band to control a car’s screen in a Garmin concept, and it kind of rocked, but not just for the gestures
- 2The Scuf Envision Pro V2 has some of the best buttons and triggers I’ve ever used, but it’s massively let down by convoluted software
- 3‘This is an unbelievable moment in the course of human history’: Sean Astin on how he’s fighting for humanity against an onslaught of AI actors
- 4The battle of the SuperPods: Nvidia challenges Huawei with Vera Rubin powered DGX cluster that can deliver 28.8 Exaflops with only 576 GPUs
- 5Acer launches 40th Ryzen AI Max+ 395 system as it pitches Veriton RA100 mini PC as an AI workstation — but unless it is keenly priced, it will struggle against better value competitors