The FBI’s Internet Crime Complaint Center (IC3) recently released its 2021 report, and it doesn’t paint a pretty picture. In 2021, the IC3 received 847,376 complaints, which is up 7% from 2020, with losses exceeding $6.9 billion.
As you might expect, ransomware was a huge issue. The IC3 received 3,729 complaints, with losses exceeding $49.2 million. The true losses may be much higher because not all attacks are reported to the IC3.
However, while ransomware gets a lot of attention, it may not be the biggest problem. The IC3 received nearly 20,000 complaints of business email compromise schemes, with total adjusted losses of almost $2.4 billion. In these sophisticated scams, fraudsters trick victims into transferring funds. Recently, criminals have taken advantage of new technology, such as deep fake audio, to make their schemes more convincing.
Attacks Are Getting Harder to Quash
You might think that you don’t need to worry about ransomware because you back up your data regularly, but you’d be wrong. Backups are smart, but they may no longer be sufficient protection against ransomware.
According to CISA, ransomware attackers are now using “triple extortion” to get victims to pay. In addition to encrypting the network, the hackers may threaten to release the data, disrupt the victim’s internet access, and inform various partners, shareholders, or suppliers.
Software Vulnerabilities Provide Access
Prevention is ideal, so it’s important to know how cybercriminals launch their attacks. The IC3 says that phishing emails, Remote Desktop Protocol (RDP) exploitation, and exploitation of software vulnerabilities are the top three initial infection vectors for ransomware.
Unpatched software vulnerabilities stand out as a major – and often needless – risk.
According to ZDNet, many applications and servers are still exposed to the Log4j vulnerability that became known in late 2021. The vulnerability allows hackers to access systems that use Log4j, and many of these systems have not applied security patches yet. Researchers at Rezilion estimate that more than 68,000 servers and 90,000 internet-facing applications are still publicly exposed to this risk.
New Targets Increase Impact
No one is safe from cyberattacks. Regardless of your organization’s size or industry, you could be hit with an attack.
According to CISA, ransomware hackers have been picking their targets in a way that can increase their impact. This involves targeting the cloud, managed service providers, and the software supply chain. Even if your cybersecurity practices are top-notch, you may have exposure through your various service and software providers.
In one example, ZDNet says that Morley Companies, an organization providing business services to multiple Fortune 500 companies, was hit with a ransomware attack that exposed the personal information of more than half a million individuals.
Cyber Insurance Claims and Rates Surge
Cyber insurance can help protect companies from the financial harm of a cyberattack. However, the surge in incidents and losses has had a major impact on the cyber insurance market.
According to the Q4 2021 P/C Market Report from the Council of Insurance Agents & Brokers, the average cyber premium increased 34.3%. Furthermore, 74% of respondents reported a decrease in underwriting capacity, with many reports of carriers requiring organizations to implement risk management plans before even providing a quote.
Managing Your Cyber Risks
Ransomware may seem like old news at this point, but the threat is bigger than ever. It’s not just ransomware, either. Cybercriminals are using a number of schemes, including business email compromise and other social engineering schemes, to separate their victims from their money.
- Back up data and make sure your backups are safe from attack but don’t count on this strategy alone.
- Apply updates and security patches as soon as they are available. Keep track of your systems and programs so you can watch for updates.
- Implement multifactor authentication and use strong, unique passwords.
- Beware of risks involving Remote Desktop Protocol. Hackers often exploit RDP vulnerabilities to gain access.
- Train your workers on how to spot and avoid phishing schemes, malicious links, and business email compromise schemes. Flagging outside emails can help, as can having procedures in place to verify requests for funds or sensitive information.
- Beware of third-party risk from your various vendors and partners.
- For more tips on things like encryption, network segmentation, and the principle of least privilege, see CISA.
Securing the right insurance coverage can also help you manage your cybersecurity exposures and stay one step ahead of ransomware trends. Heffernan can help. Learn more.
- Log in to post comments