Employees as a risk

Number of cyberattacks on companies continues to rise

(Bild: Andrey Popov - stock.adobe.com)

The number of cyberattacks on companies continues to rise, according to an international manager survey. According to the survey, over two thirds (67%) of the 2150 managers surveyed from the USA, Germany and six other European countries reported an increase in the number of attacks over the past twelve months.

This was reported by the British insurer Hiscox. In the survey's definition, "cyber attack" covers a broad spectrum from malicious phishing emails to the blocking of company networks by blackmail software (ransomware) and the detour of company funds to hacker accounts.

Employees as a risk
The most common gateway for hackers is therefore vulnerabilities when accessing cloud servers. A company's own employees are the second most common risk - for example, if they fall for phishing emails. The danger is therefore by no means only posed by criminal hackers in distant countries: 42% of respondents consider employees, subcontractors or business partners to be a risk.

Social engineering contributes to this: "This means the manipulation of employees in order to gain access to sensitive company data," said Gisa Kimmerle, Head of Cyber Insurance at Hiscox Germany. One common method is a scam known as "fake president": hackers pretend to be superiors and arrange for payments to be made to their own accounts.

"Ransom payments are not worth it"
58 percent of the companies surveyed reported financial losses caused by payment fraud, which is now the most common form of loss according to the survey. According to Kimmerle, online extortion is also still a common criminal business model. The perpetrators encrypt company networks and demand a ransom for their release.

"Ransomware is still one of the top threats," said the manager. According to the insurance manager, companies that give in and pay often do not regain unrestricted access to their systems - quite apart from the fact that these should be completely reinstalled after a successful attack anyway. "Ransom payments are not worthwhile in most cases," said Kimmerle.

In September, London-based consultancy Man Bites Dog surveyed senior executives and IT managers on behalf of the insurer, including 400 in the USA and another 250 each in Germany, the UK, France, Spain, Belgium, the Netherlands and Ireland. Three quarters of the companies surveyed were small and medium-sized enterprises with up to 1,000 employees, while one quarter were larger companies.

Cyberattacks that become public also often result in consequential damage: 43 percent of those surveyed said that they had subsequently lost customers.