Hacked, scammed and defrauded: 5 times small businesses survived a cyber attack

From a dodgy email invoice to an online phone system hack, these cases show just how easy it is for small businesses to fall victim to cyber attacks – and why cyber insurance for small business matters.

No business owner wakes up expecting a cyber attack. Until, one day, an invoice comes through that looks legit. A sophisticated-looking phishing email asks for login details. Or a ransomware attack slips through, blocks your admin access and demands a ransom to restore files. Not fun, not at all.

We heard plenty about the Medibank and Optus data breaches in 2022, but it’s small businesses that need to be on high alert. With less resources to deal with cyber threats, small businesses remain vulnerable to attacks like phishing emails and ransomware (through malicious software).

According to the Australian Small Business and Family Enterprise Ombudsman (ASBFEO), 60 per cent of all targeted cyber attacks are on small and medium enterprises – with two-thirds of those not surviving a cybercrime. Online fraud, shopping and banking are the biggest areas, the Federal Government’s Australian Cyber Security Centre (ACSC) reports.

“What the high-profile attacks on big businesses have highlighted is that everyone is vulnerable and even with strong cyber security controls in place it can take a small gap in one area to render your business subject to an attack,” says Jane Mason, Head of Product, Channels and Risk at Australia’s leading online small business insurance service provider BizCover.

“Small businesses are looking at cyber insurance as a safeguard to help navigate their way, post-attack, and also to provide the financial support needed to recover from the attack.”

BizCover found that only seven per cent of businesses have cover for cybercrime, data breaches or fraud.

From those that do, here’s what happened when they faced cyber attacks:

The hairdresser that got hacked

Business size: Five staff, $3m turnover

Like many businesses, this hairdressing salon uses a VoIP (Voice over Internet Protocol) telephone system to manage appointments and staff communication. A hacker gained access to the telephone system and made multiple unauthorised calls to a premium number over the course of a month. At the end of that month, the salon owner received their invoice, which included $30,000 of unauthorised calls.

The business owner made a claim on their cyber policy, which covered them for the complete $30,000 financial loss from the “phreaking” (or phone hacking) incident.

Retailer scammed by fake supplier

Business size: 16 staff, $5m turnover

A retailer received an invoice that seemed to be a payment request for an outstanding debt from a known supplier. Only it wasn’t. The retailer transferred $27,000 to the hacker and only discovered it was fraudulent a week later.

While they were unable to claim for the direct financial loss as their cover did not include all options. Fortunately, they could claim for remediation costs related to the attack as it involved a threatened Network Security Event. They were paid $7500 by the insurer.

Real estate agent’s $3m email fraud

Business size: Seven staff, $33m turnover

A real estate agent’s emails were hacked by a cybercriminal who posed as the real estate agent and sent multiple emails to their bank instructing for funds to be transferred into the hacker’s account. When the real estate agent discovered that three unauthorised payments had been made worth $3 million, they asked their bank to freeze the funds and they managed to recover $2.8 million of the unauthorised transactions.

Under their cyber insurance claim, they were granted legal help and an IT forensic consultant to help repair the damage to their system. They were reimbursed for $230,000.

Accountant’s client files compromised

Business size: Five staff, $2m turnover

An accountancy firm director noticed some documents on their business server had been deleted. After investigating further, they found a hacker had been accessing the system for two months. They notified their insurer, who hired an IT forensic consultant to review. They found that 800 client files were accessed, containing personal details like driver’s licences and passport numbers.

The insurer enlisted a specialist firm and a law firm to look into whether any client identities were stolen and inform anyone affected. The business needed to report the incident to the Privacy Commissioner and take steps to secure their information and repair systems. They were able to claim $90,000.

A contractor, a hotel and a fake account

Business size: 10 staff, $1m turnover

A hotel chain hired a contractor to perform works on a property. The contractor sent an invoice of $13,000. One week later, they received a fraudulent email purporting to be that same contractor saying their bank details had changed and giving a new account number to pay.

The hotel unknowingly paid the contractor $13,000 into the fake bank account. A couple of days later, the contractor followed up the hotel for payment – and both parties realised they’d been compromised. The hotel made a claim on their cyber policy and was eventually reimbursed for the direct financial loss as a result of the fraud – a total of $30,000.

All of the cases studies are real cyber liability insurance claims seen by BizCover, which provides cover options to more than 190,000 small and medium businesses across Australia.

Whether you record any sensitive customer data, use an EFTPOS machine or online gateway to collect payments or even just update your website, it pays to look into cyber liability insurance.

To find out what’s covered and to compare competitive quotes from leading insurers online, visit bizcover.com.au.

This article is brought to you by Kochie’s Business Builders in partnership with BizCover.

The provision of the claims examples are for illustrative purposes only and should not be seen as an indication as to how any potential claim will be assessed or accepted. Coverage for claims on the policy will be determined by the insurer, not BizCover.

This information is general only and does not take into account your objectives, financial situation or needs. It should not be relied upon as advice. As with any insurance, cover will be subject to the terms, conditions and exclusions contained in the policy wording. © 2022 BizCover Pty Limited, all rights reserved. ABN 68 127 707 975; AFSL 501769

Feature image: AdobeStock