MS Exchange cyberattack could release a deluge of claims
Claims from the attacks are expected to focus on legal, forensic and clean-up costs.
The insurance and reinsurance industries are likely to see a “long-tail of attritional claims” stemming from a series of cyberattacks on MS Exchange, Microsoft’s best-selling email service, according to cyber analytics firm CyberCube. The associated claims are likely to focus on legal, forensic and clean-up costs.
The attacks, which are thought to stem from Chinese state-sponsored hackers, exploit vulnerabilities on Exchange servers with the intent of placing malicious code. The codes can then be used in ransomware schemes, espionage or even to take over a system’s resources to mine for cryptocurrency, CyberCube reported. Researchers believe that 10 “advanced persistent threat actors” globally are now actively exploiting the code used in this attack.
Although the true scope of the attacks is yet to be determined, cybersecurity expert Brian Krebs estimated that roughly 30,000 organizations in the U.S. have been hacked thus far, while Bloomberg put the count closer to 60,000.
“The insurance industry is only just beginning to understand the scope of possible damage. It is too early to calculate potential losses from the theft of a corporation’s intellectual property,” William Altman, cybersecurity consultant at CyberCube, said in a release. “An accumulation of loss could result in multiple — theoretically, tens of thousands — of companies making insurance claims to cover investigation, legal, business interruption and possible regulatory fines. There is still the ongoing possibility that even more attackers will launch ransomware or other types of destructive cyberattacks.”
Only MS Exchange versions from 2013-2019 are considered vulnerable to the attacks, according to CyberCube, which noted Microsoft is releasing patches for legacy versions.
North American companies, multinationals most at risk
Companies in North America face the greatest risk exposures from the attacks, according to the cyber analytics specialist, as U.S. organizations are more likely to be using the affected Microsoft servers. Roughly 80% of MS Exchange customers are based in the U.S.
Additionally, Germany, Africa, Middle East and Australasia have also been deemed high-risk regions, according to CyberCube.
Mid- to large-size multinationals ($250 million-plus in revenue) are also facing an increasing risk, as these organizations tended to leverage MS Exchange servers before enterprise cloud computing became widely embraced. However, this is also leading small businesses to be viewed as less impacted by the incident as they tend to leverage cloud-based email systems.
Although small businesses might be insulated from this event, recent research shows that the sector, along with mid-sized organizations, will propel the cyber insurance market moving forward.
Rise of state actors
While hacking is often associated with lone wolves out for personal enrichment, nation-states are becoming more proficient and aggressive, according to retired Admiral Michael S. Rogers, former director of the National Security Agency and commander of U.S. Cyber Command.
“We went through a period between about 2011 and 2017, during which nation-states increased levels of activity,” Rogers said during a NetDiligence webinar. “This includes the NotPetya hits in the summer of 2017, probably the largest global event we’ve ever seen. And after that, given its repercussions, there seems to have been a bit of a step back.”
In supporting this finding, Rogers pointed to the 2020 SolarWinds event as well as the more recent MS Exchange breaches.
Additionally, Rogers noted traditional approaches to cybersecurity are semi-redundant for those people who transitioned to remote-work arrangements during the pandemic as infrastructure is now shared with family.
“We’re not all sitting behind a central security stack right now. Now we’re dispersed,” he explained. “We’ve blurred the lines between what is ‘business infrastructure’ and what is ‘personal infrastructure.’ The bottom line is the attack surface has just proliferated as a result.”
Related: