A recent high-profile Irish data breach highlights that a data breach is happening every 39 seconds and it is not just large organisations that are being targeted. Ransom requests of between €10,000 to €30,000 are now quite normal.

The attack on the HSE has rendered the IT system unusable until the problem is fixed which at best will be a few days, but it could be weeks or even months before things are back to normal fully and there are significant costs associated with that. Following the cyber-attack on the HSE on Friday there has also been an attack on the Department of Health and another further attack on the HSE. This was followed by public leaking of sensitive data which was highlighted by the international press.

The reality is that behind the headlines there are thousands of attacks happening every day without media reporting. Figures indicate there is an attempted cyber-attack every 39 seconds, with increased attacks during Covid-19.  Remote working and more online interaction have led to easier access points to business IT systems.

While cyber-attacks are not new anymore, methods of attack are becoming more sophisticated and successful.  It is important that every company and organization remain vigilant. Every business assesses the risk from a fire, theft or liability exposure and cyber should be no different.

One of the measures organisations should consider is arranging cyber insurance, this will provide access to expert help in dealing with these events at a fraction of the cost it would cost any organisation to deal with the issues themselves.

We have seen a number of cyber claims against accounting practices because they hold a lot of sensitive financial data. These attacks normally request a ransom to unlock the system, while the ransom may only be for a small amount: €10-30,000, the cost of the repair to the system, securing the system after the attack and the business interruption suffered; far out-ways the ransom demand with the total cost of claims exceeding €60,000 in most cases. We have also seen the same accountants being hit a number of times with demands for ransoms increasing every time.

We have also seen attacks which have accessed client data leading to reporting to the regulator. Clients also need to be told that the systems have been breached and their data has been compromised. A good cyber insurance policy will provide legal and regulatory advice on how to deal with these incidents.

We have not seen claims by companies for breach of company or personal data, but we believe this is only a matter of time before these claims are lodged. We have seen such claims frequently made in other jurisdictions.

We have been recommending cyber insurance to our clients for a number of years but over the past few days we have had increased interest from both existing and new customers due to the adverse publicity. Note that some standard professional indemnity policies have a minimal level of cyber security cover, stand alone policies will offer more comprehensive cover and combine insurance, risk management and breach response services. Specialist insurance coverage is available for:

• network interruption and recovery, 
• forensic investigation, 
• social engineering fraud, 
• network extortion, 
• electronic fraud, 
• telecommunications fraud, and 
• third party claims for breach of data.
  

Martin Adams ACII CFIRM

martinadams@arachas.ie

Arachas

Addendum from ACCA Advisory Services

While it might be tempting to simply pay the ransom it should be noted that Section 7 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 states that;

“…A person commits an offence if… the person engages in any of the following acts in relation to property that is the proceeds of criminal conduct...transferring, handling,… the property...(when) the person knows or believes...the property is the proceeds of criminal conduct.”

Paying a ransom is transferring criminal proceeds and a crime under anti-money laundering legislation. The penalty is a fine and up to 14 years in prison. Any designated person such as a bank, insurance company, accountant or solicitor who becomes aware that a ransom was paid by their client is obliged to make a suspicious transaction report in respect of that payment. The client may not be told that the report was made. A staff member in a designated business is obliged to report directly to that businesses anti-money laundering supervisor (the central bank or professional accounting body) if they become aware that a report was not made or they become aware that the business itself paid a ransom and did not report it themselves.