A BRADISH CASE STUDY
Updated March 27, 2023
It’s a nightmare scenario no business wants to face — your computer system and data are suddenly held hostage by a hacker who used malicious software (malware) to infiltrate your system. It’s called a ransomware attack, and it’s not just a bad dream. Ransomware attacks are happening with greater sophistication and increasing frequency. The good news is that you can take precautions now to avoid an attack or at least minimize the potential damage a hacker may be able to inflict.
Ransomware attacks happen to companies and organizations of all types and sizes. That includes small and medium-sized businesses.
What would you do?
Recently, a Bradish client in the financial services sector* experienced a debilitating ransomware attack. A hacker infiltrated the company’s file server and encrypted its data, locking out employees from critical programs and files. The company faced a short deadline to make a very difficult decision. Should they pay the hacker a $30,000 ransom to unlock its systems and data? Or should they say no, and completely rebuild the server and reconstruct the data? (*circumstances altered for privacy)
As the deadline approached, the company chose to take the hit and rebuild its server instead of yield to the hacker’s extortion attempt. Many would agree it was the right decision. Hackers often change the rules and demand even more money once the first ransom is paid.
Although the firm lost time and productivity and incurred the expense of paying for specialized information technology (IT) help to remediate the crisis, at least it brought the stressful episode to a close. Fortunately, the company had an insurance policy that paid for some of the forensic investigation and IT rebuilding needed to get back to business.
In some respects, the company got off easy. If the hacker had managed to actually steal the data instead of just lock it down, the company would be in for even more trouble. For one, the hacker could have threatened to release personal and financial data of clients and employees. And then there would always be the risk that the hacker would later make more demands or even sell the data to other hackers, or identity thieves, for their exploitation.
Face the facts and protect your business
The fact is, if you use the internet, your company is at risk for a cyberattack. Hackers are constantly on the prowl, searching for vulnerabilities to exploit and extort. From an IT infrastructure security perspective, there are several critically important protective steps any business should take to block a ransomware attack. (Read this article to get started.) Employee training is also critical to keeping hackers at bay. Resources are available through IT professionals as well as insurers.
Another important component of your anti-hacker plan is to equip your company with the right level of insurance to protect your assets. Insurers offer distinct levels of coverage based on what you need. Important considerations include the size (number of employees), type of company you operate and variety of systems, programs and data you work with.
Speaking in general terms, if you are concerned about your business’s operational data and processes only, or have limited customer data on file, consider adding coverage to your business owner’s insurance policy or general liability policy. On the other hand, if you collect and store payment information and other financial or personal details on clients, you probably need more coverage. This may mean an independent, comprehensive policy. Learn more here.
Reach out to your Bradish agent for help finding the appropriate insurance coverage. The right cyber insurance coverage can help your business recover from a ransomware attack.
by Kris A. Mainellis
