Almost two thirds of German companies have been victims of a cyber-attack. Nevertheless, many CEOs think that the responsibility for handling such attacks lies solely with their IT departments. That’s a big mistake.
The attackers come from cyberspace. They come as thieves, spies, saboteurs, blackmailers. They siphon off trade secrets, steal data, paralyze operations. Their targets include German machine builders, department stores, hospitals and insurance companies. Their gateway: the companies' IT systems.
Enormous losses
In Germany, 60 percent of all companies have already suffered the effects of such attacks, according to the professional services firm KPMG. The damages are enormous: lost output, ransom payments, patent losses, price slumps. Nevertheless, many CEOs believe that a cyber-attack can be handled by in-house IT. That’s a fallacy.
Costly fines
Hardly any company is in a position to handle a cyber-attack on its own. External forensic experts are usually needed to identify the attacker and track down lost data. Lawyers help communicate with regulators. That’s because cyber issues can quickly become costly. Just recently, a British airline was hit with a fine that represented 1.5 percent of annual sales, or 183 million pounds. Why? Cyber criminals had secured access to the records of 185,000 passengers.
In such instances, it is essential to rely on communications consultants who know exactly which stakeholders need to be informed when and with which messages to prevent reputational damage. For instance, one aspect that companies tend to neglect: In a ransomware attack, the IT department will often correspond directly with an attacker to find out to what extent their systems have been compromised. But what happens if the blackmailer then publishes this correspondence online? A CEO or board member needs to be in charge of the response. Further, in advance of a possible attack, the company should be set up so that it is prepared for the worst-case scenario. Already, there have been too many board members that have had to resign from their positions. Not necessarily because of a cyber-attack per se, but because of their mistakes in handling such an attack.
Contact: Fiona Claire Littig, Partner