03.03.20
Corvus Team

From Virus to Virus: Fears Over COVID-19 Can Get Your Clients Hacked

Hackers Exploit COVID-19 Fears Through Phishing Email Campaigns

It’s natural to seek clarity when a fast-evolving event is unfolding. All the better if the clarifying information comes from an authoritative source, like a government agency. Unfortunately, that’s an intuition that cybercriminals have made and used to their advantage in recent weeks.  

It’s estimated that 91% of ransomware attacks begin with an intrusion through phishing, the most common form of social engineering. For an attack type that is based on exploiting human curiosity -- victims have to want to see what is in the hyperlink or file attachment in order for a phishing attack to work -- a major event like the COVID-19 (“Coronavirus”) outbreak is a tactical gift to criminals. 

To wit: on Saturday, the World Health Organization updated its warning against phishing activity related to COVID-19, saying that phishing emails from hackers purporting to be representatives of the WHO itself have been reported. Wired also reported an example of an email claiming to be from an expert offering guidance on “Corona Virus Safety Measures”.  And earlier, Kaspersky reported an example of an email purporting to be a “Health Alert” from the Centers for Disease Control (CDC). 

So far, no reports have indicated that actual ransomware attacks have taken place as a result of these specific tactics. Then again, ransomware events are often not reported in the media or even to the government except in certain situations or in specific U.S. states where disclosures are required. 

What Brokers Should Know About Phishing Risks in a Crisis

For insurance brokers, helping clients to understand how much of a risk phishing poses to their businesses has been a key part of conversations around cyber risk transfer and mitigation for years now. Events like the virus outbreak taking place now only serve to heighten awareness and activity around these “people risks” even further.  

The best case for an organization is to avoid attacks altogether through constant vigilance, combining training and education for employees on how to spot a phishing attempt with software and hardware solutions that further reduce the chance that a phishing email even gets to an inbox. An analysis by the Corvus Data Science team found that the use of email scanning and filtering tools correlated with a 33% reduction in the likelihood of being the victim of a ransomware event.  

From an insurance perspective, clients worried about these risks will want to hear about how a policy can help them achieve the preventative measures described above, as well as how it will respond in the event of an attack. Explaining the value-added services around phishing education and preparation, as well as the pre-and post-breach response services, are a natural starting point. Then, explain the coverages of the policy in the context of the kinds of attacks that are enabled by phishing, like ransomware -- coverages things like business interruption, ransom payments, and replacement of devices. 

You can learn more about the threats of ransomware in some of our recent content.

[RELATED POST] Tech Companies: Beyond Cyber Risk, the Cost of Downstream Impact

Tech Companies: Beyond Cyber Risk, the Cost of Downstream Impact

The rise of remote work and growing concerns over ransomware acted as partners-in-crime to get organizations to hone in on risk mitigation efforts over the past couple years. Through compiling our Risk Insights Index, we found that with certain initiatives —  safer or reduced usage of RDP, growing use of email security tools, and other measures taken to limit the impact of threat actors — businesses are more prepared than a year before and ready to play defense. Those efforts are borne out in our finding that the rate of companies who pay a ransom when attacked with ransomware fell by half within a year. 

[RELATED POST] Tips from Top Brokers: How to Play Offense in a Cyber Hard Market

Tips from Top Brokers: How to Play Offense in a Cyber Hard Market

The whisperings of “firming rates” start first, quietly in business meetings, then published in industry reports. Soon to follow, rumblings of a “hard market” are brought to the conversation. It’s cyclical in nature, and we see it across all insurance lines at one point or another. For years, Cyber Insurance stretched far and wide with “soft” market conditions, remaining highly profitable. Now that period of growth, with exceedingly available coverage and inviting terms, has stalled in the face of a hard market.