It’s been months since the start of the COVID-19 crisis and we’re still learning more each day about the scope of coronavirus-themed attacks through government agencies and technology companies working tirelessly to thwart off hackers.
Here’s a roundup of this week’s COVID-19 related cyber-attacks and what organizations should be doing right now to help step up their cyber defenses.
IBM Finds Spike in COVID-19 Vulnerabilities
Since the World Health Organization (WHO) declared the pandemic on March 11, IBM has recorded a record 6,000 percent increase in COVID-19 related spam. The company also released a study this week that claims small business owners and consumers could be the most vulnerable to cyber-attacks where hackers disguise as a government entity. The study found that 35 percent of respondents expect to receive communications from the IRS via email, despite years of the agency warning that they will never email individuals regarding tax filings.
Even worse, over half of respondents claim that they would click on links or open attachments in emails pertaining to their stimulus check eligibility. COVID-19 testing availability was the second-most tempting topic that respondents claim they would willingly engage with.
To avoid falling suite to one of these attacks, it’s always recommended to be on the lookout for any COVID-19 related spam emails, never open unsolicited attachments or links from unknown sources, make sure that security updates and patches are applied regularly, and remember, the IRS will never email you.
Read the IBM Consumer & Small Business COVID-19 Awareness Study
U.S. COVID-19 Relief Fund Leaks PII on Thousands of Businesses
The Small Business Administration (SBA) revealed this week that the personal information belonging to thousands of US businesses may have been leaked online after an agency error lead to issues with applications for economic relief. The SBA acknowledged the error in a letter to impacted companies, claiming that a problem was discovered with the online portal used by businesses to apply for Economic Injury Disaster Loans (EIDLs).
A spokesperson for the SBA told NPR that the impacted portion of the website was immediate disabled and the issue was addressed and relaunched, but that Personally Identifiable Information (PII) linked to 7,900 businesses may have been disclosed to other applicants of the program before the issue was addressed. This information includes Social Security numbers, income amounts, names, addresses, and contact details.
The SBA has recently been under fire for technical glitches and administrative shortfalls that have led to significant delays in emergency government funding for US businesses. Many argue that even under strict time constrains, rigorous testing must be conducted before rolling out any new services, or risk cyber threats that could severely impact US businesses.
Cybersecurity Volunteers Join Forces to Protect Hospitals during COVID-19 Crisis
While cyber criminals originally promised to not target healthcare organizations in the wake of the coronavirus pandemic, they quickly went against their word and began launching attacks on hospitals and other critical facilities. To help combat these attacks, cybersecurity experts from around the world are coming together to work with law enforcement and government agencies to help prevent cyber attacks on healthcare providers. These groups of like minded cyber security professionals are driven by a common purpose that industry professionals must stand together to help combat the increase of COVID-19 related threats and scams.
One group in particular, the COVID-19 Cyber Threat Intelligence League (CTI League), began its work a month ago with goal of mitigating threats and protecting the global healthcare systems during the pandemic. This group has more than 1,4000 vetted members in 76 countries across 45 different sectors. So far, members have successfully taken down 2,833 cybercriminals assets of the internet and has discovered over 2,000 vulnerabilities in healthcare organizations in more than 80 countries.
League members are working with healthcare CISO’s and suppliers to notify the hospitals of what they’ve discovered, but some of the vulnerabilities are so severe that the notification is raised to the FBI or CISA.
The CTI League is not the only group working to help law enforcement and healthcare providers. The COVID-19 Cyber Threat Coalition is made up of thousands of volunteer security experts who are tracking online criminal activity. Another group, the Cyber Volunteers 19 (CV-19) , was recently set up in the UK which works to facilitate and enable volunteer matchmaking to allow healthcare services access to a pool of cybersecurity experts.
Conclusion
Organizations of all sizes and industries are being impacted on a daily basis by the policies required to combat the coronavirus. Having an understanding of the cybersecurity challenges organizations are already facing and how they are protecting against threats will help inform the decisions of security teams who face new requirements under these unique circumstances.
For more information on protecting your business during the COVID-19 pandemic, read our article on COVID-19 Pandemic: How to Maintain Privacy and Cybersecurity Vigilance or read our recent blog on The Importance of Maintaining Audit Logs in the Wake of COVID-19.
Share this post
