Chubb has issued a report, “Cyber Criminals Increasingly Target Small Businesses,” examining the emergence of new dominant strains of ransomware that are wreaking havoc on businesses, including small and midsize enterprises (“SMEs”).

Ransomware attacks typically use malicious software to block a business' network until a ransom is paid.

“Cyber criminals typically don't target specific small businesses, but they increasingly use tools that target their vulnerabilities,” said Patrick Thielen, senior vice president at Chubb's financial lines business. “Those vulnerabilities are at times technical, like unpatched software or poorly configured hardware. But even more common are those vulnerabilities involving employees who may use weak or compromised passwords, or may inadvertently click something they shouldn't have.”

“Cyber criminals know that SME leaders may mistakenly think that cyber security services are beyond their means, which makes SMEs more vulnerable to an attack,” added Anthony Dolce, vice president and cyber lead for financial lines claims at Chubb North America. “However, we are living in an age where cyber attacks are constantly evolving and threatening businesses of all sizes, but especially small to mid-size businesses. Therefore, it remains critical for companies to understand this present age and develop strong risk mitigation strategies to lessen the impact of cyber threats.”

The Chubb report examined:

  • Emotet: a type of malware leading to increased business interruption claims. Chubb has seen an increase in Emotet infections in recent months. It is sometimes observed as a precursor to other troublesome types of ransomware, including Ryuk.
  • Ryuk: a new, sophisticated ransomware strain that is particularly virulent, hard to detect, and characterized by very high ransom demands. While Chubb is seeing an increase in Ryuk claims, it also is seeing a precipitous decline in the number of SamSam ransomware attacks, which Chubb outlined in its report for the first quarter of 2018.
  • Credential Stuffing: a type of cyber attack used to gain unauthorized access to online user accounts. After purchasing email addresses and passwords on the dark web, an attacker uses botnets to programmatically target multiple online user accounts using the stolen information.

The report also highlighted the following statistics for 2018, including:

  • 21 percent of Chubb cyber incidents reported last year by small businesses involved social attacks, such as phishing;
  • 20 percent were due to error; and
  • 14 percent were due to hacking.

Learn more: www.chubb.com/cyber.