Beazley: Ransomware incidents up 25% in Q1 2020 compared to Q4 2019
While ransomware exploitations soared, business email compromise (BEC) was down 16% from the previous quarter.
The number of incidents involving ransomware reported to Beazley Breach Response (BBR) Services in the first quarter of 2020 increased by 25% compared to the fourth quarter of 2019. While all industries took a hit, manufacturing experienced the steepest increase of all, up 156% quarter on quarter.
The growing number of attacks against vendors and managed services providers contributed significantly to the increase. During the first quarter, BBR Services noted a particular spike in ransomware incidents at service providers for banks and credit unions as well as health care organizations. While ransomware exploitations soared, business email compromise (BEC) was down 16% from the previous quarter. This may be a temporary reprieve in response to COVID-19 as employees working from home may have been less responsive to emails generally, or organizations may have been more focused on ramping up remote working capacity than on identifying and reporting BEC incidents.
In the second quarter, research from security awareness training experts KnowBe4 reveals that COVID-19-related scams ranging from social media posts, smishing (text message phishing) and email phishing have skyrocketed during this time. Some of the most common scams in the United States that are on KnowBe4′s radar are The Coronavirus Aid, Relief and Economic Security Act. These involve scammers sending phishing emails and text messages telling people they need to register on a website to receive the payment. Another widespread phishing scam is a message designed to look like it comes from the White House with the most recent federal guidance about the outbreak.
KnowBe4 highlights three common scam templates that have changed over time:
- Spoofs of authoritative sources of information such as the Centers for Disease Control and Prevention, World Health Organization and Department of Health & Human Sources and company human resources departments, purportedly offering information and updates on the outbreak.
- New and novel templates designed exclusively for COVID-19 that move beyond merely offering new information on the outbreak.
- Repurposed older templates and social engineering schemes modified and updated to include a COVID-19 theme or angle.
Beazley notes seven ways information technology teams can help to protect their organization. They emphasize the use of a virtual private network, requiring multi-factor authentication and conducting security awareness training, among others.
“Cybercriminals are preying on people’s heightened anxiety during this pandemic, tricking them into clicking and sharing links that steal information. Also, those working from home may have weaker IT security than corporate networks typically provide,” Katherine Keefe, head of BBR Services, said in a statement. “Organizations must ensure their security systems and protocols are up to date and ensure that colleagues working from home are extra vigilant.”
Beazley’s full report can be found here.
Related: