FBI's IC3 2023 Report

The FBI's Internet Crime Complaint Center (IC3) released its annual cyber crimes report last week closing out the 2023 year. The #1 type of crime that continues to dominate is investment crimes. It is interesting to note that overall, Cyber based crimes cost U.S. citizens and businesses $12.5 Billion last year. The FBI established its Recovery Asset Team (RAT) in 2018 to try to mitigate the losses by freezing accounts once they have been breached. By far the biggest source of income for cyber criminals is through email phishing. With the advent of AI and image creation, cyber criminals are much better at coming up with legitimate looking emails to entice users to click and give their information away.

Business Email Compromise (BEC) due to phishing attacks leads the way in the number one attack vector that businesses need to defend against. The RAT received a complaint from an infrastructure contractor that a $50,000,000 loss occurred due to a BEC incident in New York. That RAT was able to freeze the account and was able to limit the loss to $4,000,000. A real estate transaction gone wrong was reported in Connecticut also due to BEC. The victim received a spoofed email supposedly from their attorney instructing them to wire $426,000 to a financial institution to finalize the closing. Upon receiving the report, the RAT was able to freeze $425,000 of the money to limit the loss to $1,000. These two incidents show the importance of reporting breaches to authorities immediately.

The IC3 received 21,489 BEC complaints in 2023 with adjusted losses totaling over $2.9 Billion, an average loss of $135,000. Business Email Compromise is usually initiated through a phishing email that looks like it came from legitimate sources but can be identified through a false email address (one not coming from the organization) and/or links that don't go back to the organization, Microsoft for example. However, being the second most common form of attack, it appears that people in the U.S. still fall for this criminal tactic quite often due to lack of security awareness training. Some methods to defeat this scam are, calling the person who supposedly wrote the email and verifying its authenticity, deploying Multi-Factor Authentication (MFA) as an additional security layer, and using spam/phishing filtering email services to help filter out these emails. 94% of all cyber attacks originate from this form of social engineering.

Ransomware is still a big problem and businesses in the U.S. are the #1 target. Ransomware is a type of malware that encrypts a users files and can also crawl across the network and encrypt network files. The attacker then holds the data hostage for a ransom. If the ransom is not paid, the files are kept locked. The largest problem that is encountered is that even if the ransom is paid, only 4% of victims retrieve all of their files. Only 37% of these ransomware attacks are reported to law enforcement, so gathering meaningful statistics is difficult. Needless to say that the problem is much bigger than is being reported.

If these statistics have you worried about being the next victim and you would like help in determining your current state of risk and want to know what you can do to protect your business now, download our free cyber security report here or call us at 808-377-6300 to schedule an appointment and an assessment.