Your firm may not do as much business volume as the corporate giants, but you can still face big risks from cyber crime. A new hacker group dubbed Maze has made waves in the business community with a string of nearly 30 ransomware attacks in the last few months.

The cyber crime ring targets small firms such as accountants, lawyers, medical offices, labs, construction companies and shipping firms. What makes the new crime wave different is that victims are sometimes publicly named, and their stolen, confidential information posted on Maze’s website in an effort to get the businesses to cater to ransom demands.

As a financial professional, your sensitive business data could be at risk of this and other types of cyber crime. Here’s what to know about the hacker group Maze and how you can better protect your business.

Ransomware Attacks Explained

A ransomware attack involves holding your data for ransom, but how criminals steal your data can be complicated.

Imagine you are preparing for a busy day of meetings with key clients when your computer screen goes blank. A message appears informing you of a hack and that you must pay a ransom to access your own data.

Sometimes ransomware attacks disable the computer completely, sometimes only certain files, folders or apps are affected. How the third party gained control of your files can also vary. It could have been a suspicious email, a downloaded file, a fake website or a real website that was compromised by its own attack.

Ransom payments from $500 and up are commonly demanded to decrypt the files. However, with Maze, the demands are often $1 million or more. Plus, Maze threatens victims with public exposure, revealing on its website that your business has been hacked and releasing private files that may include full business records and client files.

Businesses Hacked by Maze

A wide variety of businesses have now fallen victim to ransomware attacks by the Maze cyber crime ring. Below are some of the victims that have come forward:

  • Baker Wotring, an 11-lawyer law firm in Texas, had its data publicly exposed by a Maze attack, including fee agreements and diaries for personal injury cases in January
  • Hamilton & Naumes, a two-partner law firm in Oregon, was also reportedly the victim of a Maze hack in January
  • Another three small South Dakota law firms, 22-lawyer Bangs McCullen, 27-lawyer Lynn, Jackson, Shultz & Lebrun, and 13-lawyer Costello Porter, were reported as targets of Maze ransomware attacks in January
  • Wilson Elser, a large US firm of over 900 lawyers, was forced to take some systems offline as a precaution after a suspected Maze intrusion in February
  • MNP, a Canadian accounting firm with over 80 offices, was forced to close down for an entire week in April with accountants unable to work after a Maze hack
  • Two unnamed Manitoba, Canada law firms reportedly lost access to email, accounting software, Word files and all backups due to a sophisticated Maze attack in April
  • Cognizant, a large computer IT services firm, said it could take more than three months and cost over $50 million to recover from a Maze attack it suffered in April

Ransomware Attack Prevention

Prevention is the best strategy when it comes to any kind of ransomware attack. With Maze, email attachments are a big danger. Some Canadian law firms reported receiving suspicious messages related to COVID-19:

  • One informational email including a COVID-19 outbreak map attachment
  • A seminar invitation email to register professionals responding to COVID-19
  • Several spoofed vendor and association emails about COVID-19 with attachments
  • A series of malicious SMS (text) message links warning of firm operations changes

Other ransomware prevention tips include:

  • Choose strong, unique passwords for each device, service and network
  • Use a password management tool to keep passwords organized
  • Deploy strong encryption across phones, laptops and office workstations
  • Use encryption for any confidential or privileged client communications
  • Password-protect documents shared with clients over the network
  • Make contact by phone before accepting attachments from potential clients
  • Let your IT security handle any suspicious emails or attachments
  • Update all operating systems, browsers, extensions and add-ons
  • Keep secure backups of key business data and records
  • Hire a reputable expert to conduct a security assessment for your business

These prevention tips can help reduce the likelihood of falling victim to a cyber attack. However, even the best security procedures can’t prevent all attacks. Taking the next step by protecting your business with cyber liability insurance can give added peace of mind that you’re fully protected.