Safeguarding your business against cyber threat 

But it also brings significant risk. With everything from customers’ and employees’ personal data to the business’s intellectual property stored electronically, there’s the potential for this data to be mislaid or targeted by cyber criminals. Similarly, with businesses reliant on the internet for many of their operations, anything that prevents access can be very damaging.

Understanding the risks and taking the necessary steps to minimise them is essential. The insurance industry has an important role to play here too, with brokers able to advise their clients on the evolving risks and how cover could help to limit the financial and operational impact caused by a cyber attack or data breach.

And, with the internet and connected technologies part of virtually every business, offering this support and expertise is rapidly becoming an essential element of risk management and insurance advice.  

GDPR applies across the EU but businesses trading outside of this region will also need to consider data protection regulations in these other territories to ensure compliance. This can be complex. For instance, as data protection regulation in the U.S. is determined on both a national and a state level, a UK business with U.S. customers can find itself having to get to grips with up to 50 different sets of requirements if it suffers a data breach. 

With both the risk and the consequences ramping up, cyber insurance has a growing part to play in protecting businesses. Policies can include cover for third-party losses resulting from a data breach as well as for first-party losses such as breach costs, damage to a computer system, business interruption and ransoms in the event of cyber extortion. 

While it will look after some of the financial losses associated with a cyber attack, for many businesses, the most valuable part is the crisis management support that is available in the event of a loss. How a business manages a cyber attack or data breach can have a significant impact on the total cost as well as  its reputation and survival. Being able to access support from specialists including forensic and IT experts, lawyers and PR professionals can help keep damage to a minimum. 

For smaller businesses, which won’t necessarily have the in-house resources necessary to respond to a cyber attack or data breach, this support can be particularly important.

Cyber threats are constantly evolving, both in line with  advances in technology but also  as the criminals find new ways  to make money. Understanding  these changes, and ensuring  that cyber security is up-to-date  is essential. These are some of  the emerging threats.

Cyber hurricane 

This is the name given to an event where hackers disrupt a large number of organisations by targeting common internet infrastructure and/or service providers. As an example, a cyber attack  on a major cloud computing company could  affect all of its customers.

Internet of things  

As more smart devices become connected in  the Internet of Things, it will increase exposure  to cyber risk, especially where connected devices might have lower levels of security. For instance, criminals may be able to gain access to an organisation’s IT systems through employees’ mobile devices or the company’s connected kettle.

Computerised controls, including alarms, environmental controls and CCTV can provide  a back door for cyber criminals because they  often utilise cost effective but non-supported operating systems. Unsupported systems can be open to security threats and provide easy access to computer systems, bypassing firewalls and enabling hackers to gain access to business’s private or confidential data.

Cryptojacking 

Cryptojacking, which is also known as cryptomining malware, is where a hacker hijacks a computer  or mobile device and uses it to mine cryptocurrency on their behalf. As well as the security and ethical issues this raises, it can also push up operating costs and potentially slow down legitimate work.

Businesses of all shapes, sizes  and sectors can experience a  cyber attack but with the criminals looking to make as much money  as possible, those with the most to lose are often the most targeted. 

This means that organisations that hold a large amount of personal data are often selected, with prime sectors including financial services, telecommunications and services. 

This is changing though. More recent cyber attacks such as ransomware work on scale by attacking as many computers as possible. Then, by setting the ransom relatively low – for example Wannacry’s ransom  was $300 – it only requires a small percentage of those infected  to pay, and the criminals have made a significant return. 

Similarly, mandate and business compromise emails can affect businesses of any size or sector. 

One such victim was Dublin Zoo, where cyber criminals stole nearly €500,000, and according to NCSC, the art industry has also suffered a string of attacks with art galleries  and dealers among those targeted. 

WannaCry 

WannaCry was a ransomware attack that affected more than 300,000 computers around the world in May 2017. A self-replicating worm,  it exploited a vulnerability in the Windows operating system. Although Windows had released a patch, plenty of computers hadn’t updated their systems. 

Once infected, a computer would become encrypted, preventing it from being used. To unlock it, the user had to pay a ransom of US$300 in Bitcoin. 

Organisations of all types and sizes were affected by the attack, including Spanish telecommunications company Telefonica, the Russian Ministry of Internal Affairs and, in  the U.S., FedEx. In the UK, the NHS was a major casualty, with more  than a third of England’s NHS  trusts affected.¹³ As a result, more than 6,900 appointments were cancelled and some patients had  to travel further for accident and emergency care. 

Wannacry’s spread was stopped when a security researcher registered WannaCry’s kill switch domain. This meant that when the ransomware contacted this domain, it effectively turned itself off.

Talktalk

In October 2015, a cyber attack on telecommunications company TalkTalk enabled thieves to exploit vulnerabilities in its webpages to access customers’ personal data including names, addresses, dates of birth and financial information. In total 156,959 customers’ personal details were accessed, including the bank details for 15,656 customers. A problem was first identified when internal reports showed its network was operating more slowly than normal. Further investigation found there had been an attack and TalkTalk replaced its websites with a holding page, reported the data breach to the Information Commissioner’s Office (ICO) and started telling its customers.

The ICO’s investigation found  that TalkTalk had failed to take appropriate measures to keep its customers’ personal data secure  and issued its largest ever fine at  the time - £400,000. 

Equifax 

A cyber attack in 2017 exposed the personal details of up to 146 million people. Although the majority of these individuals were in the U.S., it included up to 15 million people in the UK, of which almost 700,000 individuals had information such as names, dates of birth and telephone numbers exposed. 

Although the compromised systems were in the U.S., the ICO launched an investigation into the steps Equifax had taken to protect the personal information of UK individuals. This found there were multiple failings at the credit reference agency, which led to personal information being retained for longer than necessary and vulnerable to unauthorised access.  In total it contravened five out of eight data protection principles under the Data Protection Act 1998. 

The ICO issued Equifax with a £500,000 fine for the breach – the maximum fine allowed at the time under the Data Protection Act 1998.