<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=1354242&amp;fmt=gif">

03.03.20

Corvus Team

From Virus to Virus: Fears Over COVID-19 Can Get Your Clients Hacked

Hackers Exploit COVID-19 Fears Through Phishing Email Campaigns

It’s natural to seek clarity when a fast-evolving event is unfolding. All the better if the clarifying information comes from an authoritative source, like a government agency. Unfortunately, that’s an intuition that cybercriminals have made and used to their advantage in recent weeks.  

It’s estimated that 91% of ransomware attacks begin with an intrusion through phishing, the most common form of social engineering. For an attack type that is based on exploiting human curiosity -- victims have to want to see what is in the hyperlink or file attachment in order for a phishing attack to work -- a major event like the COVID-19 (“Coronavirus”) outbreak is a tactical gift to criminals. 

To wit: on Saturday, the World Health Organization updated its warning against phishing activity related to COVID-19, saying that phishing emails from hackers purporting to be representatives of the WHO itself have been reported. Wired also reported an example of an email claiming to be from an expert offering guidance on “Corona Virus Safety Measures”.  And earlier, Kaspersky reported an example of an email purporting to be a “Health Alert” from the Centers for Disease Control (CDC). 

So far, no reports have indicated that actual ransomware attacks have taken place as a result of these specific tactics. Then again, ransomware events are often not reported in the media or even to the government except in certain situations or in specific U.S. states where disclosures are required. 

What Brokers Should Know About Phishing Risks in a Crisis

For insurance brokers, helping clients to understand how much of a risk phishing poses to their businesses has been a key part of conversations around cyber risk transfer and mitigation for years now. Events like the virus outbreak taking place now only serve to heighten awareness and activity around these “people risks” even further.  

The best case for an organization is to avoid attacks altogether through constant vigilance, combining training and education for employees on how to spot a phishing attempt with software and hardware solutions that further reduce the chance that a phishing email even gets to an inbox. An analysis by the Corvus Data Science team found that the use of email scanning and filtering tools correlated with a 33% reduction in the likelihood of being the victim of a ransomware event.  

From an insurance perspective, clients worried about these risks will want to hear about how a policy can help them achieve the preventative measures described above, as well as how it will respond in the event of an attack. Explaining the value-added services around phishing education and preparation, as well as the pre-and post-breach response services, are a natural starting point. Then, explain the coverages of the policy in the context of the kinds of attacks that are enabled by phishing, like ransomware -- coverages things like business interruption, ransom payments, and replacement of devices. 

You can learn more about the threats of ransomware in some of our recent content.

[RELATED POST] The Privacy Problem: A Conversation on Pixel Tracking with Experts from BakerHostetler

The Privacy Problem: A Conversation on Pixel Tracking with Experts from BakerHostetler

On January 5th, we hosted a webinar with Lynn Sessions and Paul Karlsgodt of BakerHostetler to discuss pixel tracking technology, the culprit behind the latest ad tech litigation and regulatory trend. Below is an exploration of prior and current website tracking litigation, and how it may impact non-regulated industries. 

[RELATED POST] Insurance’s Watershed: Lean Into Cyber, or Fade into Irrelevance

Insurance’s Watershed: Lean Into Cyber, or Fade into Irrelevance

At its best, insurance helps businesses manage and mitigate the risks they worry about most, and helps make everyone safer along the way. The data insurers have on effective interventions — and the lever of pricing to guide policyholders’ actions — are a powerful combination. Over time, the insurance industry has helped make buildings, work sites, and transportation safer – the key uncertainties people cared about.