As Halloween approaches, we’re reminded of things that go bump in the night, but none are scarier than the real-life threat posed by cybercriminals, and the financial and emotional impact they could have on your business.

With GOV.UK’s Cyber security breaches survey 2023 revealing 2.39 million instances of cybercrime across all UK businesses in the last 12 months, the scale of the cyber challenge has never been greater. Here we’ll explore how ransomware is still the number one threat to businesses and what you can do to be one step ahead.

 

The Cyber Kidnapper (otherwise known as ransomware)

You’ve probably heard of it, but do you really know what ransomware is? It’s a type of malicious software that ‘kidnaps’ or seizes control of your digital assets; and holds them hostage until a ransom is paid (hence the name).

Clicking on a suspicious email or document, installing software and apps from unknown sources, and opening untrusted attachments could leave your business in a vulnerable spot, leaving the door open for cybercriminals to encrypt your files making them inaccessible. Or worse, locking you out of your system entirely.

The attackers will then usually demand a ransom in exchange for providing the decryption key or access to the locked system; a potentially devastating situation for a small business with limited financial resources.

 

Getting personal 

In recent years the techniques cybercriminals use to make money have taken a more sinister turn. Rather than just encrypting data, there’s been a shift towards stealing data and threatening it’s publication, making victims feel obligated to pay the ransom. The rise in multi – layer extortion is a cause for concern, where in addition to encrypting files, a cybersecurity attack might also include file exfiltration, service disruption and extending ransoms to third-party associates.

CFC’s Tom Bennett comments “Criminals are becoming increasingly nasty and are making personal attacks against stakeholders in the business. I know of one incident where the CEO of an organisation was hit by extortion, and the organisation looked like it wasn’t going to pay. So, the criminals sent pictures of [the CEO’s] grandchild to the company with a very vague threat, in an attempt to intimidate. And it had the desired effect of making them want to cave in, to avoid any threats to life in the real world. That’s something we’re seeing more of – people getting harassing phone calls on personal numbers that the criminals have spent time to discover in order to use real-world intimidation rather than just cyber extortion to encourage them to pay.”

 

The human factor

Humans make mistakes. So we will always be the weakest link when it comes to accidently exposing an organisation to a cyber-attack. A lack of awareness, poor password security and not following processes and procedures can leave a business open to cyber threats, so investing in a robust employee cyber training programme is paramount.

Criminals will play on human emotions, gain your trust and then pressure you into acting without thinking. Spoofing and Phishing emails are a perfect example, often connected to topics that provoke a quick reaction, using tight deadlines to create a sense of urgency, and pretending to be someone in authority to convince you the message is from a trust worthy sender. Individuals shouldn’t be embarrassed if they fall victim to a scam, and businesses should ensure there is a supportive culture in place which provides regular updates and training.

 

Rebel against ransomware – 5 ways to stop your business becoming a target

So what practices can your business adopt to try to minimise the risk?

1. Be smart with software; block delivery and spread of malicious software by using a VPN, secured using multi-factor authentication for remote access to your network. And when software updates are available, apply them quickly!

2. Backup, backup, backup! It’s impossible to completely protect yourself against all attacks, so an ability to restore systems swiftly is fundamental in minimising the impact to your business. Aviva’s Cyber Pricing and Exposure Manager James Mitchell believes in using the 3-2-1 backup method:

  • 3 different copies of data
  • on 2 different types of storage device
  • 1 of which should be held off-site and disconnected from your network

3. Have a response plan; identify your critical data and digital assets, and assess the likely impact should these be attacked. Having a plan in place could minimise potential losses – click here for an example of a Cyber-continuity and Incident Response plan toolkit.

4. Don’t pay a ransom! There’s no guarantee you’ll regain access to your data, and it makes you more likely to be a target in the future.

5. Talk to your broker to ensure you have the right level of cover in place. No-one thinks they’ll be the next cyber victim but wouldn’t you sleep better knowing you’ve got the right cover in place should the worst happen?

 

 

Is your insurance up to the job?  

Make your cover work harder. Talk to one of our Cyber insurance experts today.