In June 2017, a massive cyberattack shut businesses and agencies across the globe out of their systems. Companies and government entities in 65 countries, including the US, were reporting locked systems and ransom demands by the hackers who had launched the Petya ransomware attack. Banks, airports, power grids as well as large companies were impacted. Global law firm DLA Piper, Danish shipping company Maersk and US, pharmaceutical company Merck were among the companies that announced its systems had been compromised.
It was the second cyberattack in just over a month: the WannaCry cyberattack in May 2017 targeted computers in at least 150 countries. In that attack, the UK’s healthcare system was compromised, forcing a work stoppage at hospitals across the UK when staff and medical teams could not access patient data. Telecommunications companies, auto manufacturers, and FedEx in the US also experienced interruptions that impacted operations. Early reports set losses from the .i
While the costs of the Petya attack are not yet known, estimates released at the end of June put worldwide losses at $8 billion. Even as insurers are tallying the most recent attacks, .ii But, according to , a cyber risk analytics modelling firm, a major global cyber-attack could have even bigger potential possibly triggering as much as $53 billion of economic losses, equal to those from a catastrophic natural disaster like 2012’s Superstorm Sandy.
What is certain is how lucrative ransomware attacks are for hackers: .iii Law firms increasingly are becoming the focus of ransomware attacks. As Petya spread across the world, employees arriving to work at US-based law firms were welcomed by ransom messages on their monitor screens.
The Next Cyber Victims
Small to mid-sized law firms are an increasingly attractive target because it may be easier for hackers to compromise their computer systems.
Unlike large corporations that have incident response plans in place, small to mid-sized law firms are less likely to have developed sophisticated incident response plans. In addition, at smaller firms, senior management may not see cyberattacks and ransom demands as a real threat. As a result, many firms operate without an incident response plan.
Further, where most large corporations have dedicated IT teams to ensure regular system updates and patches, as well as to detect intrusion attempts, smaller firms are less likely to have the financial means to have an IT department, staffed with full-time professionals, devoted to securing company systems.
Using insurers as allies in the fight can help smaller firms face these cyber threats with confidence.
Without an incident response plan or a robust IT department, the impact of a cyberattack on a law firm could be devastating. According to a NetDiligence report, 87% of cyber claims come from organizations with less than $2 billion in revenue. The ransom demanded for hackers to restore access to companies in the latest WannaCry and Petya attacks: $300 in Bitcoin currency (at this writing, 1 Bitcoin was equivalent to $2,342.56 US).
Loss of billings, productivity, and administrative time can cost even more than the ransom itself, which is likely to be a nuisance amount. A Providence, RI-based law firm recently filed suit against its insurer for a 2015 attack against the firm. In the suit, the firm claims an additional $700,000 in losses.
Hackers may exploit information contained in employee files, confidential business information, client business files, and even payroll information for client companies and the law firms themselves. Hackers can tie up a firm’s files and deny access for months, grinding business and productivity to a halt. Without access to firm data and to client data, lawyers may miss court filings, court dates, settlement dates, and more. The frequency of these scenarios has been increasing over the last year, and while claim total severity is decreasing ( iv), smaller companies simply are not equipped to absorb the financial impact of these incidents as well as larger entities.
Yet, often paying the ransom is not the end of the ordeal. Hackers also access important data, which can later be exposed or sold. Likewise, hackers can create openings through which they can return later to once again hold systems and data captive. The ransom payment has not erased the problem, but has masked what could be an ongoing attack.
Preventing a Breach
Despite being targeted with more frequency, law firms do have options when it comes to preventing ransom attacks. Firms can use the following methods to test their readiness and uncover weaknesses in their security/and or incident response plan:
Tabletop Exercises: Working with external vendors and/or legal counsel, firms can walk through mock scenarios that are based on their industry, stored information, outsourced information, and policies that are in place. Through these tabletop exercises, stakeholders act out a breach response to test an entity’s incident response plan or to develop a plan. A tabletop exercise allows companies to view worst-case scenarios from their clients’ perspective as well as the impact such a breach would have on their operations. Each exercise can be customized to address issues that are unique to each firm.
Information Security Policy and Procedure Review: Firms should review all security policies and procedures, particularly their agreements with external vendors, and ensure that theyhave plans in place that protect the firm from potential breach. If no policies exist, many insurers offer their clients access to resources that can help law firms establish sound, easily manageable ones.
Risk Assessments: Depending on the firm’s operations, risk assessments will vary. A forensic assessment includes a review of relationships with vendors, including the type of data shared and system access and security protocols that are in place.
Employee Training and Education: This would typically include a discussion with key stakeholders to identify and prioritize employee training needs regarding overall security awareness. Working with various cyber security vendors and risk consultancies, firms can develop customized training and educational materials that help increase network security awareness among employees and management. (Read more about raising employee awareness from my colleague Maura Wiese in her article, .)
色多多视频 Protection
Insurers offer a myriad of insurance products and endorsement options that respond to these risks, including cyberattacks. Cyber policies may include coverage for cyber, technology errors and omissions, and media, including coverage for cyber extortion, data breach response and crisis management, business interruption and extra expense as well as data recovery and defense costs.
As ransomware attacks may become more prevalent in the law firm realm, smaller firms should prepare to face these potential risks. Using insurers as allies in the fight can help smaller firms face these cyber threats with confidence.
About the Author
Danielle Roth is a Team Leader with XL Catlin’s Cyber & Technology team. She is based in New York and can be reached at Danielle.Roth@xlcatlin.com
Sources
[i] Cyence estimates.
[ii] CFC Underwriting.
[iii]
[iv] Symantec
