Business community sees ransomware as no. 1 cyberthreat

And with good reason!

Late last year, Maastricht University hit the headlines following an alarming ransomware incident. Ultimately, the university decided it had no choice but to pay off the extortionists to regain control of its own data. The incident made waves across the country. Just a few months later, our own cybersecurity survey found that businesspeople saw ransomware as the biggest cyber-threat they faced. And with good reason. Recently published US insurance data reveals that 41 per cent of all cybersecurity claims by SMEs relate to ransomware.

The fear of ransomware highlighted by our survey was all the more striking because the research took place during the coronavirus lockdown. In other words, at a time when many businesses were facing more acute challenges and when other forms of cybercrime were increasing sharply. Nevertheless, the logic is inescapable: the implications of being unable to access data can be huge – even potentially disastrous for smaller businesses.

On the lookout for easy pickings

The latest report confirms a trend that we flagged up earlier: cybercriminals are widening their search for targets. Instead of focusing on corporates, whose security is increasingly robust, crooks are looking around for easy pickings. One way they're doing that is by performing automated scans to identify websites with outdated software. The cold rationale: a softer target equals a bigger scoring chance. As a result, the cyber-attack success rate is rising. Yet most attacks could be prevented by implementing simple measures such as multi-factor authentication (MFA), the US insurance report argues.

Mail security needs to be prioritised

The report also confirmed that the adoption of mail security really needs to be seen as a priority: 54 per cent of all attacks used e-mail as a vector. The great majority of those attacks fall under the heading of BEC or CEO fraud, with the scammers pretending to be managers, staff or trading partners of the target organisations. Handling a lot of mail-based financial transactions makes an organisation particularly vulnerable. Therefore, as well as investing in e-mail security, it's vital to use alternative media to arrange or confirm financial transactions. The bold-type message on the report's first page speaks volumes: "Nothing and no one is 100% secure." Nevertheless, the authors hope that more SMEs can be persuaded to pay greater attention to cybersecurity. That implies embracing open standards (see internet.nl), e-mail security standards and services such as CyberSterk.

Listen to our three-part podcast series on cyber-resilience for SMEs

Hosted by Chris van ’t Hof, the Dutch-language podcast series 'How to Boost Your Business's Cyber-resilience' explores what SMEs need to know and what they can do to guard against attacks. Every episode is packed with practical advice for SMEs. The podcasts are available from: