Hackers are Targeting Remote Employees
The rate of security breaches has increased by 60% since the Covid-19 pandemic reached Northern America. Cybercriminals are targeting employees working from home during the pandemic, especially those who work in cloud-based environments. In fact, numerous businesses have been shut down or lost considerable sums of money due to cyber-attacks. McAfee detected 570,381 malicious attacks in the US alone between January 1 to August 24, 2020.
As the need for enterprises to quickly quarantine their workforce arose, IT departments were challenged to create fast secure work-from-home models, at the level which the security industry has never experienced. Accomplishing this monumental task required a greater reliance on employees “personal cyber hygiene” as they balanced their everyday at-home duties (navigating through these times of uncertainty) with their jobs’ technical demands. Amid this chaos, opportunistic cybercriminals saw the remote, distracted, and vulnerable workforce as a propitious target.
To deploy their attacks, cybercriminals used Covid-19 themed ransomware, Remote Desktop Protocol (RDP) exploits, scam URLs and spam designed to lure remote workers into mishandling external engagement (McAfee). Victims who clicked an unverified link or opened an ill-advised attachment, and other engagements designed to unleash the hacker’s full arsenal of malware with tactics and techniques honed to target pandemic vulnerabilities and breach internal corporate resources.
Hackers are Impersonating Reputable Organizations
Multiple vendors such as the Small Business Administration (SBA) and the National Association of Professional Employer Organizations (NAPEO) sent out “warning” signs notifying our team of cyber-attacks.
The Small Business Administration (SBA) urged applicants seeking the SBA’s Economic Injury Disaster Loan program to be alert to phishing campaigns and scams. Hackers are impersonating the SBA to collect personally identifiable information (PII) for fraudulent purposes. These acts come in the form of scam emails, asking applicants to verify their accounts using a third-party online platform.
The National Association of Professional Employer Organizations (NAPEO) announced that one of its PEO members was victim of a phishing scam. The hackers of the alleged phishing scam created fake Google advertisements to mimic the PEO’s legitimate ads. Anyone who clicked on the bogus ads were redirected to a fake log-in page where the unaware victims entered their personal information.
An Effective Solution to Protect your Business from Cyber Attacks
To prevent these scams from occurring in your organization, we urge you to reinforce the security of your employee portals with multi-factor authentication. Multi-factor authentication (MFA) is a log-in verification process that identifies and authenticates the owner of an account with two or more pieces of evidence.
Last year, we rolled out MFA in our HRIS systems Connect and XcelNet. We encourage you to adopt this feature to ensure the security of your data and company. Please remember, Connect and XcelNet are gatekeepers for your employees’ personal information (i.e. social security number, banking information, and physical address).
For instructions on how to enable MFA in XcelNet, please click here. Users of Connect should contact their XcelHR payroll representative for assistance. If you have any questions or concerns, please give us a call (800) 776-0076 or send us a message.