In today’s high-tech world, businesses are often at the mercy of cybercriminals. Every day, hundreds of thousands of attacks on businesses are launched to do everything from steal company secrets, demand money, find concealed data, or just be disruptive.
There is not a business that is immune to these attacks and even the most tech-savvy companies and people can find themselves on the wrong side of a cyberattack.
There are many ways to help reduce the likelihood of some sort of cyberattack, and the number of companies that offer protection is endless, but criminals will find a way around these steps eventually.
At The Orlando Law Group, our goal is to ensure you take the steps before and after a cyber-attack to reduce your legal liability to your customers and vendors. Our attorneys specialize in helping businesses with all types of legal issues facing them, including cybersecurity recovery.
What Can Happen?
The types of business scams using technology continue to increase and evade those companies fighting cybercrime.
For instance, just a few months ago, two of Central Florida’s most trusted institutions were hit by cyber-attacks.
At the University of Central Florida, an accountant received a notice from a vendor that their bank account had changed and that all payments needed to be sent to another bank. The university complied and sent the money to the new account not realizing the vendor’s email was hacked.
Once the money was received, the cybercriminals launched a “spam bomb” designed to overwhelm the email system to delay the discovery of the attack. It worked and the issue was not fully revealed for 12 days – and after $105,000 went missing.
Right after that, the non-profit OneBlood was attacked, and all systems were shut down until the organization was to pay a ransom. The organization eventually stopped the attack, but not before switching to manual systems to send blood to more than 220 hospitals. The attack also resulted in the data of thousands of donors to be compromised.
These are not isolated cases. The same criminals who attacked OneBlood have also attacked Rite-Aid, The Florida Department of Health and many others.
What types of scams are there?
Quite frankly, the types of online scams that are being used by criminals continue to evolve and get harder and harder to spot. With the improvements in artificial intelligence and virtual reality, it can be nearly impossible to detect a scam.
Here are a few of the ways that criminals are preying on their victims.
- AI-driven phishing emails – Phishing emails have been a way of life for users of email since the days of AOL. However, in the past, the emails were usually poorly written or just didn’t sound like the person sending them. Today, criminals are using AI to copy the voice and writing style of the person they are using. They scour social media with technology to compile the email, making it sound like you are truly talking to your customer or vendor.
- Deepfake impersonation scams – Today’s technology can almost perfectly imitate an individual with video and/or voice. This technology fooled a tremendous number of voters with a robocall sounding like President Joe Biden during the election, but that’s just one example. There are now deepfakes of a company’s CEO being sent to employees with fraudulent requests – like making a GoFundMe donation for a coworker – that work too often.
- QR code phishing (aka “quishing”) – Remember when we all stopped putting thumb drives in our computers? We’re getting to that point with QR codes now that they are being used for nearly all advertising and marketing. However, a legitimate-looking QR code could send you to a criminal’s website, giving access to all of your files and information connected to your smartphone. For many businesses, this is just about every file they own.
- Fake invoice and billing scams – This type of scam has been around for a while, but has become more complicated and harder to stop. Take the UCF example. In the past, the university could have acted quickly, but with the additional step of a spam bomb, the thieves were able to get away with the money. Again, using AI can help make the request for payment sound exactly like a vendor’s regular requests.
- Business identity theft – Identity theft is also no stranger to businesses and individuals. They made an entire movie about Frank Abagnale Jr. stealing identities and living various lives around the world long before the internet. Today, with critical records, like employer identification numbers sent freely, it’s not difficult to mimic someone’s identity. With key information, crooks can open loans, file for tax returns and much more.
These are just a few of the ways businesses can be attacked through technology. Frankly, new methods of attacks are being developed every day, making it more and more difficult to protect a business from criminals.
Are there legal ways to recover lost funds?
Unfortunately, cyber thieves are much harder to catch than the criminals of yesterday who held up banks and mugged people on the street.
In nearly all cyber crimes, criminals are very smart and can cover their tracks using technology. When someone is caught for cybercrime, it takes a substantial effort from law enforcement. Oftentimes, the criminal might be in another country – and may even be backed by an adversarial government!
For instance, in February, a cybercriminal was caught in Spain after hacking into NATO, the U.S. Army, and other high-value targets. It took more than a year and was a combined effort of the National Cryptologic Centre of the National Intelligence Centre of Spain, EUROPOL and U.S. Homeland Security Investigations.
Of course, the first step after any cyberattack is to call law enforcement to start the investigation to find the criminals, however, in most cases, local law enforcement is not equipped to find the criminals because the resources and the technology are extremely specialized and very expensive.
It’s unfortunate, but in most cases, there will be very little recovery of any data or funds stolen during a cyberattack.
Prepare for your defense – before the attack
While a personal or business loss is unfortunate, it only affects the individual or business. Businesses run into significant issues when a customer’s data or money is stolen as part of a cyberattack.
In that case, your company could be found liable and be forced to pay significant legal fees, fines and payments to customers for a breach. In some cases, the result is a class-action lawsuit against the company.
Recently, Equifax had to pay approximately $575 million because of a security breach that compromised the information of more than 150 million people in 2017. Investigators found out that Equifax could have prevented the attack by fixing a known flaw in its systems. It also failed to quickly inform its customers of the breach.
According to CSO, a website dedicated to cybersecurity issues, of the $575 million, “$300 million of that will go to a fund providing affected consumers with credit monitoring services (another $125 million will be added if the initial payment is not enough to compensate consumers), $175 million will go to 48 states, the District of Columbia and Puerto Rico, and $100 million will go to the Consumer Financial Protection Bureau. The settlement also requires the company to obtain third-party assessments of its information security program every two years.”
You can read more about that and other high-profile cases here.
Take steps now to protect yourself
There is no sure way to prevent a lawsuit from your customers or vendors after a cyberattack, but you can take steps now to increase the likelihood of a successful defense of a lawsuit.
First, find a cybersecurity firm with a proven track record of preventing cyber-attacks. Many companies offer cybersecurity, so you must do your due diligence.
The insurance company, Brown & Brown, wrote a great article on how to pick a great cybersecurity company here. But their nine key aspects are:
- Primary Focus on Cybersecurity
- Customizable Service Offerings
- Desire for Long-Term Relationship
- Understands Every Endpoint
- Data-Driven Defenses
- Diverse Client Base
- No Conflicts of Interest
- Exceptional Customer Service
- Money Matters but Cost Isn’t Everything
Brown & Brown also recommends cyber insurance, which we would recommend as well as another layer of protection for when your business is attacked.
After you’ve hired a cyber security company and installed all the technology needed, it is then time to establish your protocols for what happens after a breach and how to notify customers.
If you are dealing with medical records, HIPPA then it is fairly straightforward as the United States Department of Health and Human Services has specific guidelines on what to do found here.
While non-medical companies are not required to follow these steps, they actually provide a great framework for any business to follow.
For instance, HHS guidance says:
“These individual notifications must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach and must include, to the extent possible, a brief description of the breach, a description of the types of information that were involved in the breach, the steps affected individuals should take to protect themselves from potential harm, a brief description of what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further breaches.”
By following this format, you are making sure the victims of the breach – a company’s customers and vendors – can take action quickly to stop any further damage. In addition, you can offer some sort of way to help, such as providing free credit monitoring for anyone who would like it.
That said, waiting after a breach to put together a plan can be costly for a business. A company should put together the plan as soon as possible and be ready to activate the plan as soon as a breach is discovered.
The Orlando Law Group can help your business prepare for an eventual cyberattack and will be there for you when it happens to mitigate as much liability as possible for your business.
The attorneys at The Orlando Law Group help businesses and organizations in Orlando, Waterford Lakes, Altamonte Springs, Winter Garden, Lake Nona, St. Cloud, Kissimmee, and throughout Central Florida with all types of business law, including legal protections in a cyber-attack.
If you have questions about anything discussed in this article or other legal matters, give our office a call at 407-512-4394 or fill out our online contact form to schedule a consultation to discuss your case. We have an office conveniently located at 12301 Lake Underhill Rd, Suite 213, Orlando, FL 32828, as well as offices in Seminole, Osceola and West Orange counties to assist you.
The articles on this blog are for informative purposes only and are no substitute for legal advice or an attorney-client relationship. If you are seeking legal advice, please contact our law firm directly.