Cyber claims stemming from email attacks grew by 24% in 2023, according to a recent report from the cyber insurance provider At-Bay.

Larger companies with annual revenue greater than $100 million saw the highest overall increase in frequency with three times more email claims than companies under $25 million, the data showed. The three top most-targeted industries for email crime in 2023 and the first half of 2024 were manufacturing, finance and law firms.

“Everyone has email, and everyone is susceptible to attacks that leverage it,” Adam Tyra, general manager of Security Services at At-Bay, told PropertyCasualty360.com.

“While much of the security product market remains fixated on identifying and blocking ransomware, attackers are increasingly avoiding sophisticated security tools by turning victims’ own email systems against them,” he added. “Email abuse netted attackers as much as $5 million in some cases.”

Key findings from the report include:

• Financial fraud was the most common cybercrime committed over email, accounting for three of five email claims in 2023 (61%), worsening to more than two-thirds (72%) in the first half of 2024.
• The average amount of funds stolen in a financial fraud incident was $219,000. In the most severe cases, threat actors stole more than $5 million. The real estate industry saw the worst financial fraud cases with an average stolen funds amount of $434,000.
• Threat actors aren’t always after cash — they’re fraudulently redirecting goods, with 4.5% of the incidents analyzed involved goods delivered to a threat actor without payment, spanning everything from Christmas decorations, to beauty products and paper towels.

“Businesses need to get much better at securing their email systems and at identifying emails that aren’t legitimate,” Tyra said.

“Fraud detection performance of email solutions and email security tools varies widely,” he continued. “Some currently available solutions simply don’t stand up against the fraud tactics that criminals are using today and others need to be continuously tuned and managed to remain effective.”

According to At-Bay, Google Workspace customers experienced 54% fewer incidents compared to the average, while businesses using Microsoft 365 had a claims frequency 45% higher than the overall average.

At the same time, Google Workspace customers experienced three times fewer cyber insurance claims compared to Microsoft 365 customers.

See also:

• The insurance industry is at an AI adoption crossroads
• NY releases industry guidance on AI-related cybersecurity risks
• Cyber insurance is make-or-break for these businesses