Beazley points to 133% growth in business email compromises

Beazley Breach Response (BBR) Services, the dedicated in-house team which works with BBR policyholders, has seen a 133% rise in business email compromises (BEC). These included what Beazley described as a fresh form of online bribery.

“Opportunistic cyber criminals are engaging in a new, darker strain of email compromise by attempting to bribe recipients into paying cryptocurrency ransoms using so-called ‘sextortion’ tactics,” said the specialist insurer in its latest breach insights report.

“A typical case of sextortion investigated by BBR Services involves an email from someone claiming to have accessed the recipient’s work computer and found the addresses of pornographic websites they have viewed. The sender says they have simultaneously recorded footage of the recipient as they watched these sites using their webcam, and threatens to share the files with their email contacts if demands are not met.”

The good news is, these messages in 2018 proved to be hoaxes.

“There is no sign yet that the targets of sextortion are anything other than random, and it often turns out that no data has been compromised,” noted Beazley.

It added, however, that if email recipients in fact engaged in inappropriate behaviour using their work computer, they could fall victim to extortion. Demands for cryptocurrency range from hundreds to thousands of dollars.  

“BBR Services is seeing sextortion emails being sent to individuals in multiple countries, including the UK, and across different industry sectors, from SME to large business,” said international breach response manager Helen Nuttall, who recommends alerting the company’s IT department if the email came from the business email domain.

“These emails are convincing as they often appear to come from within the individual’s own email account,” she explained. “This immediately makes the recipient believe that the account has been compromised. Combine this with the fear of potentially humiliating content being distributed to your friends/family/colleagues, it is easy to see why people are lured into paying the bribe.”

BBR Services head Katherine Keefe, for her part, urges employers to treat BEC seriously. She said organisations need to ensure that the workforce is aware of practical measures to protect their data as well of ways to reduce the instances of compromises escalating into a more serious cyber incident.