Small businesses in the United Kingdom are the target of an estimated 65,000 attempted cyber attacks every day, according to new figures from specialist global insurer Hiscox.
In a statement, Hiscox said that its estimates were based on tests undertaken by the insurer that monitor, in real-time, the total number of attempted attacks on three “honeypot” computer systems typical of those used by small firms across the country.
The total number of attempted attacks ranged from 900 to 359,000 in each 24 period, averaging 65,000 over the three weeks the servers were monitored.
To raise awareness of this issue, Hiscox is live streaming the number of attempted attacks to its website at www.hiscox.co.uk/cyberlive and also broadcasting the figures live on over 100 billboards across the United Kingdom.
According to the insurer, almost one in three (30 percent) U.K. small businesses suffered a cyber breach last year – equivalent to over 4,500 successful attacks per day or one every 19 seconds.
Cyber security incidents cost the average small business £25,700 last year in direct costs (e.g. ransoms paid and hardware replaced) but this is just the beginning. Indirect costs such as damage to reputation, the impact of losing customers, and the difficulty attracting future customers remained unmeasured but was expected to significantly exceed this.
James Brady, head of cyber for Hiscox U.K. and Ireland, commented, “We know small businesses in the U.K. are hot targets for cyber criminals and these figures highlight the alarming extent of this. Most small businesses recognize the threat that cyber criminals pose on a global scale, but are less convinced of the risks facing their own operations, considering themselves 'too small' to be worthy targets, but this just isn't the case.
“Hackers are prolific and sophisticated which makes staying on top of cyber security a challenge for all organizations. With many small businesses lacking credible cyber security strategies to help manage and prevent such attacks however, the impact when they do occur can be disproportionality severe.
“Outsourcing cyber security management is one option as this can be a more cost effective way to access instant, scalable resources in the event of an attack. The best cyber insurance policies will provide exactly that – practical support including legal advice, forensics, and reputation management to help get a business back up and running as quickly as possible.”
When questioned, only 52 percent of U.K. small businesses stated that they had a clear cyber security strategy in place to manage the impact of an attack, which Hiscox said could significantly hamper their ability to detect, manage, and prevent security breaches, as well as make the overall impact much more severe.
Experts agree that communication during and after a cyber attack is critical to managing it, yet only 56 percent could say with confidence that they fully disclosed details of a cyber attack to the relevant internal and external stakeholders. This was particularly concerning, Hiscox added, given the introduction of GDPR this year, which requires all organizations to report a data breach to the Information Commissioner's Office (“ICO”) within 72 hours and notify affected customers without undue delay.
Most alarming of all, Hiscox said, was that the majority (66 percent) of those that suffered an attack admitted to making no changes to their policies or systems to help prevent further breaches in the future. According to Hiscox, this was perhaps one of the key reasons why over half (56 percent) of those who have suffered a breach were the victim of multiple attacks.