Welcome back to our three-part series examining vulnerabilities surrounding family offices and steps they can take to mitigate those risks. In Part One we discussed how family offices are particularly vulnerable to cyber-crime. Here, we will review different types and trends of cyberattacks.
Cyberattack Trends
Most cyberattacks are the result of “phishing” emails. “Phishing” refers to a deceptive effort to obtain the recipient’s sensitive information by disguising the sender as someone the recipient knows and would trust. Phishing recipients can be deceived into downloading malicious software, providing personal information like account numbers or PINs, wiring funds or paying invoices to cyber-criminals. Ransomware is malware that denies the victim access to their system’s files until the victim pays a ransom. While malware can also take the form of “drive-by” downloading when a victim visits a website prompting the malware to download, over 90% of malware is still delivered via email.
Those sending phishing emails will lure recipients into opening the emails by making the email appear as though it came from a familiar address – in particular, cyber-criminals will seek to impersonate executive email accounts since those individuals would have the authority to authorize wire transfers or provide highly confidential financial information, like account numbers, that the fraudster can then use to steal up to millions of dollars. One family office recently lost $10 million as a result of a cyberattack. Fraudsters may also impersonate a vendor or business partner with whom the victim has a longstanding and familiar relationship. In these cases, the “vendor” (meaning the cyber-criminal) asks the business via email for payment to be a wire transfer to a new account. In order to deceive the victim, the fraudster will send the request from an email account that closely resembles that of the vendor or business partner. Another variation of this scheme involves the cyber-criminal stealing information outlining how the business engages with its suppliers. Using this information, the bad actor will issue a fraudulent invoice to one of the business’s suppliers asking it to send a wire transfer to a new account. In addition to fraudulent emails seeking a wire transfer, victims also report that fraudsters using a compromised business executive’s email will seek out W-2 data or other personal information that can be used to hack private bank accounts.
Ransomware attacks are increasing yearly along with the attendant dollar amount of ransom paid in response to these attacks. In 2016, the FBI estimated there were as many as 4,000 ransomware attacks on any given day—a 300% increase over 2015. The FBI valued the amount of ransom paid in just the first three months of 2016 at $209 million, a staggering increase from the $1.6 million paid during all of 2015.
Family offices are particularly apt targets for cybercriminals as they may be more willing to give into a cybercriminal’s demands given the value of their data, their generally lower levels of security, their net wealth and their concerns about publicity.
Stay tuned for Part Three where we will examine how to defend against cyberattacks.