NHS Cyber Attack Friday 12th May 2017 – A Wake Up Call for SMEs?

May 15th, 2017

The ransomware cyber attack on the NHS and other organisations across the world on Friday last week has been described as perhaps the worst cyber incident in history by some cyber experts certainly in terms of the number of organisations affected.

The profile of targets like the NHS and the sheer scale of the incident has attracted global media coverage and has put a spotlight on the growing threat of global cyber criminality against large organisations. However the reality is that SME’s are just as likely targets for cyber criminals, as they are often woefully unprepared and lack the security, resource or expertise to deal with the consequences of such an attack. The difference is that cyber-attacks on SMEs go largely unreported. Indeed a number of our own SME clients have fallen victim to cyber-attacks over the last 12 months.

To help you understand the cyber risks that your business faces we have put together some key points:

QUICK STATS ON CYBER CRIME

WHAT DRIVES CYBER CRIMINALS?

1. Data

2. System Interruption

3. Money

WHAT ARE THE SPECIFIC THREATS?

System Interruption by Malware

Software which is specifically designed to disrupt, damage or gain unauthorised access to a computer system.

Ransomware

Malicious software designed to block access to a computer system until a sum of money is paid.

Phishing

Where criminals send emails purporting to be from reputable companies in order to induce individuals to reveal personal information such as passwords and credit card numbers.

Distributed Denial of Service (DDOS) attacks 

This type of attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources.

Cyber extortion

This is an attack coupled with a demand for money to avert or stop the attack.

Rogue employees

Where a disgruntled employee maliciously targets their employer. For example a sacked employee who hasn’t yet had access rights removed, posts sensitive information on social media putting the employer in breach of privacy legislation and liable to pay costs including notification, damages, expenses and credit monitoring.

Negligent employees

Undeliberate or careless acts carried out by employees which lead to a data breach. For example an employee leaves a laptop on a train which isn’t password protected and which contains sensitive client information. The information is accessed by criminals who use the information to obtain fraudulent loans. The victims or “data subjects” then sue the employer for financial loss.

THE RISK TO YOUR BUSINESS

The risks can be broken down into two main areas:

Third Party Losses

These are losses suffered by third parties who might make a claim against your business resulting from an attack or breach of their data which you hold. An example of this might be an individual whose personal data is stolen from your company and fraudulently used to obtain loans or credit. Another example might be legal action and fines from regulatory bodies such as the ICO (Information Commissioners Office) for allowing a data breach to occur.

First Party Losses

This is the direct financial loss suffered by your business following a breach or attack. For example the additional costs needed to restore your systems, or the lost revenue for any downtime resulting from an attack.

IS MY BUSINESS INSURED AGAINST CYBER CRIME?

Cover for this “emerging risk” is not automatically included within standard insurance policies which are designed for events such as fire, flood, road collisions and general liability despite the fact that in 2017 a business is more likely to suffer a cyber-attack than a fire or burglary.

Most businesses now rely in some way on computer software or systems to operate, handling everything from customer databases to fully automated manufacturing processes. This dependence on technology as a fundamental cornerstone of operations leaves businesses more exposed to cyber risks than ever and for this reason, as part of a wider cyber risk management strategy, a specialist cyber liability policy is highly recommended.

WHAT CYBER COVER IS AVAILABLE AND WHAT DOES A CYBER INSURANCE CLAIM LOOK LIKE?

A good cyber policy should include some or all of the following features:

First Response 

This pays for a team of IT specialists to immediately respond to a threat as it happens or immediately afterwards.

Cyber Liability

This covers your business against claims from third parties or data subjects following a data breach.

Business Interruption

This covers the lost revenue which results from the interruption to the business after a breach or attack.

Data Breach Notification Costs

This covers the costs involved in notifying relevant data subjects or authorities e.g. Information Commissioners Office

Information and Communication Asset Rectification

This covers the costs associated with recovering systems and data

Public Relations

This covers the cost of hiring a PR agency to deal with the adverse publicity generated from a breach.

IT Forensics

This covers the cost of IT forensics to establish the severity and identify the cause of a breach, so that control can be regained and the business can be protected in future.

Credit Monitoring

This covers the cost of monitoring the credit worthiness of your data subjects for a period after a data breach, to ensure that their identities are not being used for fraudulent gains.

Telephone Hacking

This covers the cost of the telephone systems being hacked and calls dialled out to premium rate phone numbers

Computer Crime

This covers the direct financial loss suffered following an IT system breach e.g. your banking system is breached and is money transferred out of the business.

OTHER REASONS TO PROTECT YOUR BUSINESS AGAINST CYBER CRIMINALS

General Data Protection Regulation (GDRP) is due to come into force in May 2018 which brings with it hefty fines for non-compliance and more onerous obligations than ever before in relation to data breaches.

For example, organisations are required to notify a data breach to the ICO “without undue delay, and where feasible, not later than 72 hours” unless the breach is “unlikely to result in a risk to the rights and freedoms of natural persons”

Champion Insurance Brokers work with a number of specialist cyber insurers who offer bespoke cyber cover including valuable ancillary support services to get your business back on its feet after a cyber-attack. These policies can be tailored to suit your business’s needs.

If you want to learn more about how to protect your business against the threat of cyber-crime, please contact us on 03330 430 430 or info@champion-insurance.co.uk


BACK TO NEWS PAGE »
Latest News

NHS Cyber Attack Friday 12th May 2017 - ...

May 15th 2017

The ransomware cyber attack on the NHS and other organisations across the world on Friday last week ...

Taking on the World's Toughest Rowing Ra...

April 21st 2017

After completing an epic trek across the South Pole in 2014/15 and the North Pole in 2013, Andy Styl...

Focus
management accounts

Our Management Accounts service takes this headache away from you. By providing accu...

corporate finance

We help raise finance, advising on the best methods for a given situation, identify ...

SPOTLIGHT ON R&D

CRATE Brewery

CRATE Brewery produces 500,000 litres of beer per year and runs three retail bars, all whilst constantly evolving and updating its own-brand recipes with tweaks, trials and experimental brews.

Our Tweets

Champion Accountants

Growth Protection Core Support Menu
Contact