Phishing Attacks & the Impact on Businesses

Phishing remains a huge concern for both individuals and businesses in 2023. Last year, it was reported that phishing represented the top approach of cyber attackers in regards to gaining initial access to data/information – coming in at 41%. Attackers and their approaches are getting more sophisticated and harder to distinguish from authentic communications. They’ve even increased the use of “vishing” or voice phishing which are campaigns that add phone calls to their attacks. It makes sense, as attacks utilizing vishing are three times as effective.

How Does Phishing Occur?

Phishing is essentially fraud – more specifically the practice of sending emails (or making voice calls) pretending to be from reputable individuals or companies – with the end goal of luring the recipient into providing personal or confidential information. On the individual level, that might include website passwords, financial/payment information, or other personal data. Doing so compromises the security of those individuals’ financial and personal affairs, which can be devastating. For businesses, the risk is amplified as the loss of confidential business information carries impacts far beyond the company to its customers and employees as well.

Potential Operational & Financial Costs of a Phishing Attack

While Q4 numbers aren’t quite in, Q3 of 2022 resulted in a staggering record-breaking number of phishing attacks. According to the Anti-Phishing Working Group (APWG), at least 1,270,883 total phishing attacks occurred in Q3 – making it the worst quarter for phishing ever observed. What do these attacks cost the businesses and individuals they impact? Because phishing simply represents an approach by cyber criminals, costs vary greatly depending on the type of attack the phishing scheme unleashes.

IBM estimates that the cost of a data breach in a cyber attack averaged

4.35 million dollars in 2022, an increase of over 2% from the previous year. Even higher was the average cost of a typical ransomware attack – 4.54 million dollars. That average doesn’t even take into account the ransom amount. Ransomware, viruses, and other malware can all be unleashed via a phishing attack. So, the financial impact of phishing on a business can be devastating.

Costs might include investigation and legal fees, bringing in external consultants to advise during an attack, the cost of replacing or upgrading technology (hardware/software), and nearly countless other costs that add up in resolving a cyber attack. One cost not often discussed is insurance – more specifically, the increase in premium that is likely in the case of a data breach. The cyber insurance industry has been drastically raising premiums in recent years due to the increasing costs of data breaches and cyber attacks. Attacks occurring because of a successful phishing attempt often mean even higher costs for insured businesses – much like a car accident impacts auto insurance premiums.

Additional Organizational Impacts of Phishing

Beyond the financial impact of phishing and the cyber attacks it initiates, targeted organizations often experience other impacts felt both internally and externally. Among employees, productivity and morale can suffer if they feel an attack signifies a lack of security and protection from their employer. Especially within organizations that don’t prioritize email security training, it’s often an employee who’s been targeted and is responsible for the attack’s success. In reality, it’s an organization’s responsibility to ensure its staff is prepared and knowledgeable enough to avoid phishing attacks. Reactive training sessions after an attack occurs feel like a punishment for employees, often impacting overall morale.

The external image of a company can also be impacted if a phishing attempt deems successful in allowing a data breach. A company’s stakeholders extend far beyond the business owners and employees. Every individual who interacts with the organization – including vendors, customers, and the general public – has an impression of the organization’s value and image. Obviously, no company welcomes a cyber attack with open arms. However, failing to adequately prepare and take preventative measures against them can tarnish the brand image and reputation among its many stakeholders.

Data breaches also often have legal ramifications. Factoring in any regulatory penalties assigned and the impact of the breach on personnel and employee data, it’s often months (or years) before all the legal proceedings and implications conclude. The longer any legal resolution takes, the higher those fees are going to climb as well.

Protecting your Business from Phishing Attacks

While phishing attempts and their creators have gotten more sophisticated in recent years, many of them can be defended against with proper cybersecurity training for all employees – ideally from a team of IT experts. Remaining proactive is the best way to defend against phishing and other cyber attacks and protect your business assets. Training from Kustura Technologies is comprehensive and driven by industry best practices. It includes:

• Interactive Training:  Employees learn how to identify and avoid phishing attempts
• Simulated Attacks: The best way to become skilled in identifying phishing attempts is via simulations similar to what they might experience daily.
• Password Exposure Testing: Organizations receive a comprehensive analysis of password strengths and vulnerabilities.

Trainees also learn how to respond to ransomware and proactive steps to keep their business email accounts secure. In order to best protect against phishing and other attacks, it’s important to have a baseline of where the organization’s cybersecurity stands currently. Kustura Technologies and our team of IT professionals can help both assess your level of protection now and develop and implement the appropriate IT and cybersecurity solutions to better protect your company, its employees, and all other stakeholders moving forward. Contact our team today to get started!