What you are about to read is a real story showing you how a business can be devastated by cybercriminals in the blink of an eye. Most importantly, I will share several ways this could have been avoided. Make sure to forward this to anyone who might be making online payments and, better yet, your entire staff. The name of the company and principals have been withheld so they do not become a further target.
$43,000 gone in the blink of an eye
Imagine, on a normal Friday night after a long week of work, you glance down at your phone and see an alert from your bank.
You open it to find that you have just paid a company you have never heard of $43,000!
This was an all-too-real situation for one small business owner a few weeks ago – and there is NOTHING the owner, or police, or anyone else can do to get that money back. It is gone forever.
Thankfully, for this company, $43,000 was a loss they could absorb, but it was still a huge hit and, frankly, they are lucky they were not taken for more.
Here is what happened and how you can keep this from happening to you.
The E-mail that started it all
Imagine receiving an e-mail so convincing, so utterly devoid of red flags, that you find yourself compelled to act. This is not a failure of judgment; it is a testament to the sophistication of modern cyberthreats.
In this case, an employee in the accounting department received an e-mail from the company’s “CEO” saying they were starting to work with a new company and needed to get them set up in the system and make a payment to them right away.
This was NOT an abnormal type of e-mail, nor was the amount anything that aroused suspicion – they made and received large amounts of money often.
The only telltale clue might have been that it came in on a Friday afternoon and it was made clear that it was an urgent matter that had to be handled right away.
The employee, thinking they were doing exactly what their boss wanted, set the attacker’s company up in the system, including their bank routing number, and made a payment. And the minute they hit “Send,” the money was never to be seen again.
It was not until the CEO called minutes later, after receiving notification of the transfer, that alarm bells started to ring! But by then it was all too late.
So What Happened?
While it is impossible to know what exactly occurred to kick off this chain of events, the most likely culprit is that an employee, possibly even the owner, received an e-mail sent by a cybercriminal weeks or even months earlier that allowed this person to gain access to some of the company’s systems.
In all likelihood, the e-mail looked normal and had a link that, when clicked, downloaded software onto the recipient’s computer, and that is where things started to go wrong.
Over the following weeks, the cybercriminals accessed company communications, figuring out who the players were, and devised a plan to make it look like the CEO needed a vendor to be paid urgently.
And when the criminals determined the time was right, they “attacked” and walked away with $43,000 for their efforts.
Home Alone
While this scenario may sound far-fetched, it is not new.
If you remember seeing the classic movie Home Alone, would-be thieves watched houses immediately preceding Christmas to determine which families would be away for the holidays so they could break into those homes.
Cybercriminals do the same thing, but from a distance, and you would never know they were ever there.
The scary fact is, your system could be compromised right now, and you would have no way of knowing it, until an attack happens.
In the cybercrime world, the kind of attack this company suffered is referred to as spear phishing. Criminals identify a single point or person in an organization who they believe could fall victim to a scam like the one that happened here, and they engineer a scheme to specifically target them.
What you and your Employees need to know to help thwart attacks
The sad fact is that there is no 100% safeguard against cybercriminals. But, just like our robbers in Home Alone, cybercriminals go after the low-hanging fruit. If your house has a gated entry, security system, outside cameras, and lights, and has three vicious-looking dogs roaming around, would-be thieves are much more likely just to move on to a house without all these layers of security.
Cybercriminals operate in the exact same fashion, looking for companies that are not protected and then targeting them specifically. So, the best thing you can do is have layers of protection for your company, along with education for your employees.
3 Things to do right now to protect your Company
- Multi-factor authentication (MFA), also called two-factor authentication (2FA), is not just a tool but also a shield against the relentless barrage of cyberthreats. An example of MFA is when you try to log into a program, and it sends a code to your cell phone via text that needs to be entered before granting access to the program. While often deemed a nuisance, MFA is not an inconvenience – it is the digital equivalent of locking your doors at night. It is a simple yet profoundly effective measure that can be the difference between a secure business and a cautionary tale.
- Employees are your first line of defense. Just like you would teach your kids not to open the door for someone they do not know, you NEED to educate your employees on malicious threats. Teaching them about the common scams, how to avoid them and what to do if they think they have inadvertently clicked a link they should not have, is key. You need to ask your IT company to provide this training, and often they have programs that you can require your employees to go through a couple of times a year. The program then quizzes them to ensure they have the knowledge. While this process is not something you or they will look forward to, the reality is that it could take just 10 to 15 minutes a couple times a year to keep you out of the news and your money out of someone else’s account!
Get cyber security services in place. MFA is just the start of a comprehensive security plan. You need to talk to a qualified company (not your uncle Larry who helps you on the side) about getting more than a firewall and virus scan software. What worked a decade or two ago – and may still be helpful on a home network – would be like protecting a bank vault with a ring camera. It is just not going to cut it. NOTE: We offer a variety of security services for companies of all sizes and can certainly talk to you about options that make sense for your situation.
Whatever you do, Do Not Do This!!!
Maybe the worst thing the owner of the company that lost $43,000 did was they then posted a video and story on social media.
While their intentions were good because they wanted to warn other business owners not to fall victim to the same scam, they might as well have had T-shirts made with a big target on the back.
It would be like having cash from your house taken, then going online and telling people exactly how it happened – you are just inviting more people to come and try to take your cash.
Not sure if you are as protected and prepared as you should be?
To make sure you are properly protected, get a FREE, no-obligation Cyber Security Risk Assessment. During this assessment, we will review your entire system, so you know exactly if and where you are vulnerable to an attack.
Schedule your assessment with one of our senior advisors by calling us at 414-764-4465 or going to https://dk-systems.com/call