The increase in cyber-attacks on regular, small / medium sized businesses in the last 18 months has been alarming. Here are the most common attacks we see, and hope you don’t have to.
We are using the term “hacking” generally here, however the majority of instances we have witnessed will involve one or more of the following techniques:
- Using email to trick your users into logging in to what they believe to be a legitimate Office 365 website (or other online service), in order to capture their username and password (“Phishing”).
- Scouring your user’s email history for information that could be used to defraud you or a customer / supplier you have worked with. This usually involves finding a high-value invoice which can be doctored to have new bank details, and then re-sending it to the original payee.
- Adding an inbox rule, so that all of your email gets copied to an external email address, so that even if you change your password, the hacker continues to receive copies of your email in order to design a hacking attempt on you or your customers / suppliers.
- Sending you an email, appearing to come from a known contact, in order to get you to open an attachment, which subsequently and immediately encrypts ALL of your data on your computer and your network. You are then encouraged to pay a fee (typically tens of thousands of pounds,) in order to have your data returned to you (ransomware).
- Placing phone calls to your accounts department, quoting the names of people such as colleagues, customers or suppliers, in order to appear genuine. These calls can appear to be harmless surveys to determine who your key suppliers are. They can often be followed up by an email or phone call, weeks later, claiming to be from that supplier, and requesting that you amend their bank details for the next payment run, or chasing you for an overdue payment.
