Ransomware attacks pose increasing risk to financial services providers and the small businesses they serve. Consumers also are now more frequently targeted by ransomware attacks, as cybercriminals shift their focus toward less suspecting, and less protected, targets. Ransomware is an interesting type of malware attack, in that criminals gain profits by extorting funds directly from their victims rather than by extracting payouts via account takeovers or scams. 

While takeovers and scams can be waged against targets in tandem with ransomware attacks, the primary means of profit come directly from the ransoms paid in exchange for the return of data or access to data encrypted by criminals. Sometimes the data is returned; sometimes it is not, regardless of whether a fee is paid. This report explores the challenges financial services providers face, not only when it comes to being attacked themselves, but in the counsel and education they offer to business customers and consumers about how to defend themselves against falling victim to a ransomware attack, how to protect data from being stolen, and how to recover the data should a ransomware attack prove successful. Data loss prevention is the focus, and for financial institutions and businesses, it begins with updated disaster recovery and business continuity planning. 

Key questions discussed in this report:

1. How should organizations of all sizes better address data loss prevention via disaster recovery and business continuity planning?
2. What vulnerabilities in endpoint security and cyber-insurance protection are attackers exploiting as part of their ransomware attacks?
3. Why is paying ransoms, even when data are “recovered,” continually putting businesses at risk and posing unique concerns for financial institutions and their small-business clients?
    

Companies Mentioned:

Cybersecurity & Infrastructure Security Agency, Department of Treasury, Federal Bureau of Investigation, Financial Crimes Enforcement Network