“While how the third party gained unauthorized access has not been disclosed, this is yet another example of the importance of proper investment in cybersecurity programs to protect company and customer data," says Terence Jackson, Chief Information Security Officer at Thycotic. "Attackers are not taking it easy during the pandemic. They are stepping the attacks up and we have to be ready.”

According to Caroline Thompson, Head of Underwriting at Cowbell Cyber, ransomware is now targeting all industries and evolving into a new form of data breach as criminals not only ‘steal access’ by placing a bounty to regain access to data and assets, but also threaten to steal the data itself. 

"Moving forward, businesses should evaluate cyber insurance for every coverage and assistance that the policy might provide prior, during and after a cyber incident," Thompson adds. "Insurance underwriters should refine their risk assessment approach by collecting data that accounts for today’s new work-from-home model and also demand access to cloud configurations (inside-out data) to refine their risk selection. Furthermore, they should potentially decline coverages if security best practices, such as multi-factor authentication (MFA) are not implemented. Coverages addressing social engineering incidents and ransomware should be revised with clear definitions on included or excluded devices and adequate limits. Insurance offerings should be built using data, artificial intelligence (AI) and continuous underwriting – ingesting new data in real-time and rapidly respond to today’s ever-changing threat landscape.  The increased complexity in cyber insurance makes it a good time for policyholders to consider a standalone cyber policy that brings clarity into what’s covered or not, and provides adequate limits.”

Steve Durbin, Managing Director of the Information Security Forum, notes that organizations should rethink their defensive model, particularly business continuity and disaster recovery plans to protect against the scale and scope of these types of threats. "Established plans that depend on employees being able to work from home, for example, do not stand up to an attack that removes connectivity or personally targets individuals as a means of dropping ransomware into the corporate infrastructure.  Revised plans should cover threats to periods of operational downtime caused by attacks. Creating a cyber-savvy workforce that takes information security seriously, while nurturing a culture of trust, will help to eliminate poor security practices as well as diminish the number and scale of incidents,” Durbin says.