Cybersecurity Concerns for Mid-Sized Businesses and Increasing Ransomware Harassment Tactics

Two security stories I wanted to highlight.  Huntress Labs with some new survey data in its State of Cybersecurity for Mid-Sized Businesses in 2023.     Highlights:

• 49% of mid-sized businesses plan to budget more for cyber security in 2023
• In the last twelve months, 24% of mid-sized businesses have suffered a cyber attack or are unsure if they have suffered a cyber attack
• 61% of mid-sized businesses do not have dedicated cybersecurity experts in their organization
• 47% of mid-sized businesses do not currently have an incident response plan
• 27% of mid-sized businesses reported having no cyber insurance coverage

And, while 69% of respondents reported they must carry some form of cyber insurance, nearly 30% reported having no cyber insurance coverage.

The second story is from Palo Alto Networks’ Unit 42, a report on incident response and threat intelligence.  The data –drawn only from cases responded to by Unit 42, so it is by no means a complete or wholly accurate assessment of activity volumes – found that ransomware gangs used harassment as a tactic 20 times more often last year than they did in 2021.   Quoting Computer Weekly

Typically, harassment in a ransomware case is aimed at a specific individual, often in a leadership role at a victim organization or its customers. It involves a series of increasingly aggressive phone calls and emails to pressure them into paying a ransom or to pressure customers into pressurizing those who are empowered to pay a ransom to do so. It may also involve cyber criminals spreading the word about the attack on social media or contacting technology journalists.

This is on top of existing layered extortion techniques, which besides encryption of data, include data exfiltration and leakage – seen in 70% of attacks last year, up by 30% on 2021 – and distributed denial of service (DDoS) attacks – seen in around 2% of ransomware incidents. 

Mid-market companies are just as unprepared as their small business counterparts.    What surprises me is the disparity between those who report they must carry insurance… and those who don’t.     I don’t know why – and that seems like the critical insight.  Perhaps the answers will vary, but this is the question I’d be focusing on with customers and potential customers.  Is that an active choice or a passive one, and what’s the reasoning behind it?   Understanding that unlocks critical insight.