Cyber threats are now the primary concern among business owners, and the statistics warrant the concern. Ransomware activity has increased more than 300 percent in the past three years (AON 2022 Report). A ransomware attack occurs every 11 seconds (Travelers Cybersecurity Playbook Webinar, 2021).
Given the increase in activity, a cyber-attack has become an inevitability. Preparing to respond to an attack is now equally as important as protecting your business from an attack.
A Worse Case Scenario
Late last year, a client of mine in the manufacturing industry frantically called me early one Monday morning, saying his entire system had been breached. He explained to me that he arrived early at his office and was experiencing difficulty logging into his computer systems. Moments later, his entire administrative staff proclaimed that they could not log on either. Within a few minutes, a single email message appeared on his computer stating “they” have had complete control of his system for the last 12 days. They presented three files that would prove their claim of possession. First, the company’s financials and banking accounts; second, a complete list of all their customers with financial and payment data; and lastly, a complete list of all current and former employees and their personal information.
For many years, I quoted the option of buying a Cyber liability policy that would help prevent and mitigate any possible losses at a price of about $7,000.00 annually. I was told the company had a third-party IT company that stores and transfers everything to the cloud and that he was fully protected.
Within an hour, he was contacted by the “hackers,” who were a very well-known eastern European group that even had their own website on the dark web. They demanded a seven-figure price to release back the information and data, of which the owner hung up on them.
Increasing Cyber-Awareness
Consequently, organizational cyber hygiene must be a priority to mitigate cyber risk. There are numerous policies and tools that business leaders can tap into to lessen their risk and increase their resiliency.
Every organizational cyber security plan should begin with a culture of cyber-awareness that starts with the leadership and executive team. Employee training is the number one tool to prevent cyber-attacks – no amount of cyber security technology can prevent your employees from clicking on a phishing link. An incident response plan should also be created and tested regularly. Every person in the business should be aware of their role in responding to an attack and resuming operations – one of the largest drivers of claim costs is inefficiencies and confusion following an attack.
In these situations, time is key. We immediately started the following procedures to secure operations and build his systems back piece by piece: Identify a quick reaction data forensics team to conduct a comprehensive breach response, consult their legal counsel, notify law enforcement FBI and Secret Service, clearly describe what you know about the compromise and what information was taken, and notify clients, financial institutions, and past and current employees.
Protect Today to Prepare for Tomorrow
After many painstaking weeks and sleepless nights, he slowly built his systems back, as well as kept up with his day-to-day business. The overall costs were just under $500,000 – some of the expenses being purchasing a year of “LifeLock” protection for all his clients and past and present employees, new systems to fix vulnerabilities and deter future data loss, forensic specialists, and much more.
In addition to organizational policies and procedures, business leaders should work with their tech partners to implement network protection such as multi-factor authentication, endpoint monitoring, regular updates and patches to software, and a data backup plan.
Business leaders should start to consider cyber insurance companies as partners like the partnerships they share with work comp insurers. Cyber insurers and brokers offer a broad suite of cyber risk management tools and services to help companies reduce their risk.
MEET
Todd Chollet is a Cyber practice leader for Lakenan Insurance Group. Todd is a seasoned risk advisor specializing in providing business leaders specific expertise in Cyber / Tech liability exposures.
Roy Reichold is a Senior Risk Advisor at Lakenan Agency with 25 years in the insurance industry. Business owners hire him for his comprehensive understanding of risk. Roy’s focus is to protect a company’s capitol efficiencies and develop asset protection strategies and procedures.
Related Reading
Too Late, You’re Hacked! – Defending Your Small Business’ Computers and Networks is written for small businesses with a limited understanding of IT (Information Technology) that encounter cybersecurity challenges. This book introduces critical IT terms and concepts in today’s complex digital age, and it is intended for owners or professionals handling their business’ IT department with narrow expertise.
To order Too Late, You’re Hacked!, click here.
