The business is a battlefield – and the attacks are coming from cyberspace. It’s a visible war with plenty of high-profile casualties. The Equifax data breach of 2017 revealed the personal information of 143 million people. The Yahoo breach left billions of accounts vulnerable; a recent disclosure revealed that every Yahoo account was affected. Uber customers totaling 57 million found a ride – and had their personal data stolen.

Many small and medium-sized businesses are not acting quickly to protect themselves. “My business is smaller than those mammoth companies,” owners say. “Can the risk really be that high?” The answer is a resounding yes. Small and medium-sized business owners who believe it won’t happen to us do so at their own peril. It’s not just the ‘big fish’ who are targets; two out of three cyberattacks are now directed at small businesses. The reason for this is clear: these entities often do not employ adequate security measures. Add an absence of insurance protection to the equation, and a breach can be exceptionally disastrous. It’s a problem of preparation AND protection. Without the proper security in place, a breach may occur with ease – and without insurance coverage to handle the aftermath, the result can be financially devastating.

The takeaway is this: the threat of cyberattack does not necessarily increase as the size of a business does. Companies of all sizes are at risk. For proof, let’s examine real-life cautionary stories of Tampa Bay Area small businesses as reported by St. Petersburg insurance agency Wallace Welch & Willingham Inc (W3 Insurance). In the below examples, the businesses affected lacked adequate crime coverage, which did not include cyber-related losses.

Scenario One: The Classic Hack

In hindsight, it’s obvious that the accounting software was ‘a sitting duck,’ as the saying goes. A hacker found a way into the payroll program and methodically added fake employees to the roster one by one, shuttling money to an outside account and leading to more than $200,000 in losses before the hack was discovered.

Scenario Two: The Patient Robber

Some cyber criminals are exceedingly persistent. This one did his homework in a major way, learning about the company’s employees and customers in detail. He then requested a wire transfer from a client to a fake email address that read suspiciously close to a salesperson’s address. The money was wired without a second thought, and the result was a loss of thousands of dollars.

Scenario Three: The Last-Minute Switch

Yet another criminal accessed a seller account on a transaction. He monitored the email exchange between the buyer and the seller. Just as the transaction was to close, he sent an email with fraudulent wire instructions to the buyer from within the seller’s own email account. The seller naturally assumed the wire instructions were correct – and wired $388,000 to the criminal.

None of the above companies had adequate cyber insurance coverage in place as a safeguard. What could have been a simple add-on to an existing policy is now ultimately viewed by these organizations as a huge lapse in judgement.

Regardless of how a breach occurs, the end result is the same: potential economic devastation. Businesses may store private customer information protected by law; a cyberattack can create havoc for a business owner from a first and third-party standpoint. The business owner could lose access to valuable data necessary to run their business, resulting in a temporary shutdown and perhaps even a ransom to restore it.

If customer data is breached, the business could face lawsuits from third parties for not providing adequate protection of sensitive information, as well as government fines and penalties for certain types of legally protected data. After probable costs of legal fees, data forensics, public relations consultants, notification and data monitoring services are totaled, the loss is staggering. The 2018 average cost is $148 per breached record.

In this cyberattack battlefield, a two-pronged approach is necessary for the protection of businesses, no matter their size. By implementing loss control measures to avoid or reduce exposure to cyber risk and purchasing a cyber insurance policy specifically designed to cover this type of loss, organizations can avoid becoming a statistic.

Those who decline to prepare face a stark reality. Bankruptcy is a common occurrence for those businesses who choose to ignore the danger. The National Cyber Security Alliance states that a staggering 60% of small businesses close their doors for good within six months of a cyberattack.

It’s obvious that the need for cyber protection is dire, and there’s no one-size-fits-all answer for preparation and coverage. Encrypting important data is just one strategy, as is consulting with an insurance professional knowledgeable about cyber risk policies. Professionals like those at W3 Insurance examine the risk of each business and advise accordingly.

Based on reports of trillions of dollars being stolen from businesses, cyber criminals are winning this war. It’s time for all organizations to form a proper defense and to have a backup plan in the form of cyber security coverage if attacks do succeed.

---

1. Federal Trade Commission, The Equifax Data Breach, https://www.ftc.gov/equifax-data-breach
2. Natt Garun, Yahoo Says All 3 Billion User Accounts Were Impacted by 2013 Security Breach, The Verge (Oct. 3, 2017), https://www.theverge.com/2017/10/3/16414306/yahoo-security-data-breach-3-billion-verizon
3. Mike Isaac, Katie Benner and Sheera Frenkel, Uber Hid 2016 Breach, Paying Hackers to Delete Stolen Data, New York Times (Nov. 21, 2017), https://www.nytimes.com/2017/11/21/technology/uber-hack.html
4. Steve Strauss, Cyber Threat is Huge for Small Businesses, USA Today (Oct. 20, 2017), https://www.usatoday.com/story/money/columnist/strauss/2017/10/20/cyber-threat-huge-small-businesses/782716001/
5. IBM.com, https://ibm.co/2Qiah9g
6. Gary Miller, 60% of Companies That Suffer a Cyber Attack Are Out of Business Within Six Months, The Denver Post (March 24, 2017), https://www.denverpost.com/2016/10/23/small-companies-cyber-attack-out-of-business/

Odds are high that your business will be affected by a cyberattack. We’ve all heard of the recent casualties of the Cyber War: an Equifax data breach revealed the personal information of 145 million customers. The Yahoo breach left 3 billion accounts vulnerable. Uber customers totaling 57 million found a ride – and had their personal data stolen.

But my business is smaller than these, you say. Is my risk really that high?

The answer is a resounding yes. According to USA Today, nearly two out of three cyberattacks are now directed at small businesses. Their vulnerability exists due to a perception they are not the target and the absence of insurance protection after the event. It’s a problem of preparation AND protection. Without the proper security in place, a breach may occur – and without insurance coverage to handle the aftermath, the result can be financially devastating.

Cyber insurance is likely necessary regardless of your company’s size. For proof, examine the following scenarios. Both are real-life cautionary stories from Bay Area small businesses.

Looking back, it’s obvious that the accounting software was easy to breach. A hacker found a way in and methodically added fake employees one by one, shuttling money to an outside account and leading to more than $200,000 in losses.

Another cyber criminal did his homework in a major way, learning about the company’s employees and customers in detail. He then requested a wire transfer from a client to a fake email address that read suspiciously close to a salesperson’s. -The result? Thousands of dollars lost.

Regardless of how a breach occurs, the end result is the same: potential economic devastation. Businesses may store private customer information protected by law, and a cyberattack can create havoc for a business owner from a first and third-party standpoint. The business owner could lose access to valuable data necessary to run their business, resulting in a temporary shutdown and perhaps even a ransom to restore it.

If customer data is breached, the business could face lawsuits from third parties for not adequately protecting information, as well as government fines and penalties for certain types of legally protected data. After probable costs of legal fees, data forensics, public relations consultants, notification and data monitoring services are totaled, the loss is staggering. According to the Ponemon Institute, the average cost is $154 to $158 per breached record.

Adequately protect your business with a two-pronged approach. By implementing loss control measures to avoid or reduce your exposure to cyber risk and purchasing a cyber insurance policy specifically designed to cover this type of loss, you can avoid becoming a statistic.

According to a 2016 survey conducted by Risk.net, risk management executives named cyberattacks as the top emerging risk to their business – and there’s no one-size-fits-all answer for coverage. Invite an experienced insurance advisor to examine your risk and recommend the correct course of action.

Gauge your company’s current vulnerability. Download the free Cyber Risk Exposure Scorecard and contact us to learn more about Cyber Risk Management services that protect your business.

75% of businesses that suffer major property damage close within three years. These businesses lacked a contingency plan and/or proper financing to aid in recovery.

So many possibilities exist for a business interruption to occur that it’s hard to imagine not preparing for one of them. Here in Florida, floods abound. Hurricanes and tropical storms shift course on a moment’s notice, offering little time for people to brace for impact. Is your business prepared for such an occurrence? Will a business interruption present a roadblock that permanently damages your organization, or will proper planning reveal a stepping stone that leads to future success?

[Read more…]

According to NOAA (National Oceanic and Atmospheric Administration), a natural disaster has affected every US region since 2011. Are you prepared? Are your employees prepared? Is your business prepared? There are lots of resources available from FEMA and FloridaDisaster.org, the Florida Division of Emergency Management, to assist with building an emergency plan for businesses and families.

[Read more…]

How does your small business collect and store sensitive, confidential customer data and financial information?  If you said on your laptop, backed up to the cloud and accessible with your smartphone or tablet, you are not alone.  Your business, like most in this increasingly cyber-dependent age, is susceptible to a data breach.  Did you know that 1 in 3 documented data breaches occur in businesses with less than 100 employees?¹  Additionally, 60% of small businesses close their doors within 6 months following a cyber attack.² 

[Read more…]

Running a business can be tough, and choosing the right type of commercial insurance can be even tougher. With the wide variety of agents, brokers, products, and services available today, making the right decision is difficult. Choosing the right products and buying them from the right agent often brings fear of the unknown and paralysis of analysis (or the paradox of choice). Cut through the weeds of insurance and streamline your business decision-making process.

[Read more…]