140 local governments held hostage by ransomware attacks
IBM Security X-Force Threat Intelligence VIP Wendi Whitmore discusses cybersecurity and what they tell cities when they encounter a ransomware attack.
A data breach is an incident in which a victim’s sensitive information is accessed without permission.
Continue Reading Below
That's according to Patrick Costello, co-founder of cyber insurance firm Evolve MGA, which specializes in helping businesses get coverage for all the costs associated with cyberattacks and data breaches, including loss of income, reputational harm and extortion costs.
While there are many different types of data breaches, Costello says ransomware claims are the most common.
Costello explained ransomware like this: A user gets a notice on a computer, smartphone or another device that says something like, "This is an FYI: You won't be able to access your computer system or data unless you pay us a select amount of cryptocurrency in 24 hours. And if you don't, we'll shut down your systems or expose all your information on the internet."
Evolve and other cybersecurity firms receive ransomware claims the most often because this type of attack is successful for bad actors in the sense that it creates panic among victims and therefore gives attackers access to data and money in a very short period of time.
WAWA BREACH: OVER 30M PAYMENT RECORDS POSTED FOR SALE ON DARK WEB
Many of these attackers remain anonymous and are hard to trace because they operate from foreign countries, making them difficult for law enforcement to track down. Ransomware is also fairly easy for cybercriminals to get their hands — or cursors — on.
"You can literally download ransomware from the dark web and send it out to the masses," Costello told FOX Business.
He brought up one example of a broker his company discovered on the dark web "who was giving away ransomware software for free and then taking a commission" from the criminals who used it to make money.
"Ransomware attacks are reported every 40 seconds," he said, but "the majority of businesses never report it."