Newsletters
Risk Central
Digital EditionThird-Party Disruption Remains Main Driver for Increased Cyber Risk: Coalition
2024 may go down as the year that third-party cyber disruptions became the new normal for businesses, with high-profile events like ransomware attacks on Change Healthcare and CDK Global, and a global IT outage caused by CrowdStrike, according to Coalition’s 2024 Cyber Claims Report Mid-year Update.
Ransomware reared its ugly head once again in the first half of 2024, driving a concerning 14% increase in overall cyber insurance claims severity, the report noted. With an average loss amount of $353,000, the resurgence of ransomware as a high return-on-investment cybercrime proved costly for many businesses. However, despite this alarming spike, successful negotiations were able to cut actual ransom demands in half, Coalition stated.
Business email compromise (BEC) also continued its reign as the leading type of cyber event, accounting for nearly one-third of all reported claims. The frequency of BEC incidents ticked up another 4% compared to the previous six months, maintaining a steady upward trend that persisted throughout all of 2023, according to the report.
Certain industries found themselves in the crosshairs of these threats more than others. In the financial services sector, businesses with under $25 million in revenue saw a 20% uptick in BEC frequency, while those in the $25-100 million revenue range experienced an even more dramatic 390% spike, per the report. Consumer discretionary businesses were also prime targets, with those generating over $100 million in revenue hit by a staggering 250% jump in BEC incidents.
Third-Party Disruptions Create Widespread Impact
The report touched on two material cyber risk aggregation events occurring in the first half of 2024 that highlighted the fragility of the shared technology infrastructure on which many businesses rely.
In February, Change Healthcare, a company that processes transactions among pharmacies, care providers, and health insurers, experienced a ransomware attack that left it unable to provide critical services for over a month. The disruption impacted more than 90% of pharmacies across the U.S., with total projected losses reaching $1.6 billion. Nearly 23% of health care businesses with more than $100 million in revenue were impacted by the Change Healthcare attack, as were 11% of those with $25-100 million in revenue, according to Coalition.
The other major event involved CDK Global, a provider of technology solutions to auto dealerships, in which dealerships were unable to conduct new sales and manage inventory, resulting in extended delays for customers and lost revenue.
The CrowdStrike event in July, which grounded airlines, knocked federal agencies offline, and forced emergency dispatchers to resort to pen and paper, also was an aggregation event, but is not covered in the midyear report, Coalition noted.
The common thread in these events is the shared dependency on technology, underscoring not only how many businesses rely on the same technology infrastructure to operate but also how fragile that technology can be. Third-party risk will continue to impact businesses of all sizes and industries, and cyber risk aggregation will remain a key consideration for cyber insurance providers going forward, Coalition found.
Emerging Trends and Risk Factors to Watch
As cyber criminals continue to evolve their tactics, several worrying trends emerged in the first half of 2024 that businesses should be aware of, which include the growing risk posed by exposed login panels to web-accessible applications. Businesses using these were found to be 3.1 times more likely to experience a cyber attack, as threat actors increasingly troll the internet looking for such vulnerabilities to exploit for easy access, per the report.
Another concerning development is the potential use of artificial intelligence (AI) by cyber criminals to supercharge their attacks, especially when it comes to BEC events, the report noted.
While concrete evidence is still limited, security experts believe AI-enabled BEC attacks are likely already happening and could explain the alarming 60% spike in BEC frequency seen among large businesses with over $100 million in revenue, the report noted.
Also steadily on the rise are non-encryption system compromise events like data breaches, which accounted for nearly two-thirds of all cyber incidents outside the “big three” of ransomware, funds transfer fraud, and BEC. The silver lining, Coalition stated, is that the slight decrease in overall ransomware frequency suggests better security controls may be helping to keep these system compromises somewhat in check.
Access the full report here. &
