In the past year, we’ve seen key emerging cyber trends as bad actors up their game with more sophisticated and targeted attacks against businesses. According to a report by Identity Theft Resource Center (ITRC), 2020 saw a continued trend among cybercriminals in moving away from mass attacks seeking consumer information and toward attacks that target businesses using stolen logins and passwords. Criminals are less interested in stealing mass amounts of consumers’ personal information, said ITRC, and are looking to take advantage of bad consumer behaviors to attack businesses through ransomware and phishing tactics.
Ransomware and business email compromise (BEC) attacks directed at organizations generally require only a stolen credential or for an employee to click on a link in an unsolicited email, text, or social media account. Ransomware and phishing require less effort, are largely automated, and generate payouts that are much higher than the amounts gained from taking over the accounts of individuals. One ransomware attack can generate as much revenue in minutes as hundreds of individual identity theft attempts over months or years, according to ITRC.
Ransomware is defined as “malicious software that infects your computer and displays messages demanding a fee to be paid in order for your system to work again.” The malware can be installed through deceptive links in an email message, instant message or website, and has the ability to lock a computer screen or encrypt important, predetermined files with a password. The criminals ask for ransomware typically in the form of cryptocurrency to unlock the files.
In a BEC scam, criminals send an email message that appears to come from a known source making a legitimate request. For example, a criminal impersonates a vendor that a company regularly deals with and sends an invoice with an updated mailing address for payment. Or, a bad actor impersonates the company CEO asking an assistant to purchase dozens of gift cards to send out as employee rewards. The assistant asks for the serial numbers so he or she can email them out right away. The criminals use slight variations on legitimate addresses (such as firstname.lastname@example.org vs. email@example.com) to fool victims into thinking fake accounts are authentic.
The High Cost of Cyberattacks
Some stats to consider and share with your insureds so they understand why cyberattacks are a real threat:
- The average ransomware payout was $233,000 per event in Q4 2020, up from $10,000 in Q3 2018
- Business email compromise scams cost companies more than $1.8 billion in 2019 with the average loss up 48% through the first three quarters of 2020
The Cyber Impact of Remote Work
Remote work has served to further compromise cybersecurity. According to Verizon’s recently released 2021 Mobile Security Index, 45% of its survey respondents say their companies are sacrificing mobile-device security to just “get the job done.” In addition, more than one in five companies surveyed said their mobile-device security was compromised, involving the loss of data or creating operations disruptions in the preceding year. And two-thirds of respondents said that mobile device-related risks increased in the past year.
“The pandemic caused a global shift in the way organizations operate … While businesses focused their efforts elsewhere, cybercriminals saw a wealth of new opportunities to strike,” Verizon Business Chief Revenue Officer Sampath Sowmyanarayansaid in a statement. “With the rise of the remote workforce and the spike in mobile device usage, the threat landscape changed, which for organizations means there is a greater need to hone in on mobile security.”
Mobile phishing attempts, for example, increased by a staggering 364% in 2020 compared to the prioryear.
The Importance of Cyber Insurance
As cybercriminals become more opportunistic, Cyber insurance has become even more critical in an organization’s resiliency plan. Industries of all types – from hospitality to real estate and community associations and habitational – are realizing the need for specific, tailored Cyber policies to address their unique needs. It’s important to educate clients on the threats they face and how Cyber insurance can be designed to respond to these threats in the event of a loss. A Cyber insurance partner will help with the expense of forensics, notification, breach coaching, reputational management, ransomware/cyber extortion, business interruption as a result of the attack, and other costs in addition to implementation of risk-mitigation strategies.