Cybercriminals have hit more than 40 countries with hidden malware that steals passwords and financial data, said PwC in its latest Weekly Cyber Security Report.. The malware is not found on hard drives as it hides in the memory of compromised computers, making it almost “invisible” as criminals exfiltrate system administrators’ credentials and other sensitive data. When a targeted machine is rebooted, nearly all traces of the malware disappear, the report added.
Over 140 enterprise networks –banks, government organizations and telecommunication companies –from 40 countries have been hit, according to Kaspersky Lab. The cybercriminals are using methods and sophisticated malware previously used by nation-state attackers. The U.S. has been the most targeted country with 21 hidden-malware attacks, followed by 10 attacks in France, nine in Ecuador, eight in Kenya, and seven in both the UK and Russia, the report said.
“The reason why such cyber attacks are happening today is because of the ineffective implementation of the payment security standards,” SISA Chief Executive Officer D Shanthamurthy said. “With demonetisation, and with an increase in the number of digital payments, such attacks are going to get worse,” he added.
The “attacks are ongoing globally against banks themselves,” said Kaspersky Lab’s Kurt Baumgartner. “The banks have not been adequately prepared in many cases to deal with this.” The attackers are “targeting computers that run automatic teller machines” in order to push “money out of the banks from within the banks.”
According to the report, 19 banks and 641 customers had complained of fraudulent withdrawals amounting to Rs 1.3 crore, the National Payments Corporation of India had said on October 21, 2016. At least 32 lakh debit cards were compromised because of the breach, which was first reported only after several customers complained to banks that their cards had been used in China at various ATMs and point of sale terminals. The Centre had said that it would take action against the perpetrators.
With instances of cyber threats increasing, the banks, which are increasingly going digital prodded by government and regulators following note-ban, are looking for cyber insurance -- a fledgling industry vertical for general insurers but having large growth potential. The country reportedly lost a whopping USD 4 billion in fiscal 2016 to cyber crimes, while globally, the economic loss due to cyber crimes stood at USD 455 billion in 2016.
According to insurance industry reports, cyber crimes are growing at 40-50% annually globally. Similarly, global cyber risk insurance premium stood at USD 3.5 billion in 2016, which was only USD 2.5 billion in 2015, amply indicating growing incidents of cyber crimes across the world. Country's largest lender State Bank, which fell victim to cyber frauds late last year, is now considering insurance to protect its over 30 crore customers.
"As we are now planning to take cyber covers for our customers, we have already asked one of the companies which are on the bank's panel of insurance advisers to prepare a report for us in this direction," said Rajnish Kumar, MD, SBI. Similarly, Bank of Baroda, which had seen about 1 lakh of its debit cards being compromised in the recent episode, is also keen to go for such insurance covers in future.
General insurers also see a rise in demand for cyber risk insurance. "We are in talks with quite a few banks to provide cyber insurance cover to them," New India Assurance Chairman G Srinivasan said without divulging any details. "Cyber threat is on the rise in recent times for the banks and therefore they must go for cyber insurance cover," Srinivasan said.
Bajaj Allianz General Insurance Chief Technical Officer for non-motor business, Sasikumar Adidamu, said cyber insurance has seen close to 20% rise at Bajaj Allianz in the current fiscal. He also said that in-line with rising incidents of cyber threats, the industry has seen a 10-15% uptake of cyber liability covers.
Insurance brokers are sensing good business here too. "We are in talks with around 20 state-owned banks which are seriously looking for cyber insurance cover. But no deal has been materialised so far," Anand Rathi Insurance Brokers Director Supriya Rathi said.
"We are looking for completing the cyber insurance deal at around Rs 20-25 crore by the next fiscal year and Rs 50 crore within next couple of years," she added. Apart from Anand Rathi Insurance Brokers, Aon Global and Marsh are the two insurance brokers which are also active on the space in the domestic market. The insurance brokerage charge for cyber cover for banks may go as high as up to 12.5% of the premium underwritten. Surprisingly, the industry base for cyber insurance in the country is currently at Rs 60 crore only. Non-life insurers that provide cyber insurance cover include New India Assurance, National Insurance, ICICI Lombard, Tata AIG, HDFC Ergo and Bajaj Allianz.
Notably, between September and October last year, the domestic banks faced their worst breaches of financial data, as 3.2 million debit card customers of leading banks were hit by data theft where their debit card details were compromised. Several victims had even reported unauthorised use of their card from far away locations in China.