Cyber Case Studies for SMEs

Understanding how your business could be affected by a cyberattack and preparing an incident response plan could save you from financial ruin.

These case studies are from real Cyber incidents. They highlight the impact on two SME businesses and describe how Chubb’s Cyber ERM policy can help you contain a cyber threat. 

Case Study 1: Network Attack

A data centre which hosted an online retail company’s website became the target of a distributed denial of service (DDoS) attack.

The incident, which utilised hacked IoT (Internet of Things) devices, flooded the data centre’s network with so much traffic that their network failed. This made the online retail company’s website inaccessible for a period of six hours before backup systems were able to restore 100% functionality.

After telephoning the Chubb Incident Response Hotline, an Incident Response Manager was assigned to the incident.
 

Financial Impact

Recovery Costs:
Increased cost of working required to get website functioning properly: $18,000
Costs to subcontract with external service provider: $23,000

Business Interruption:
Lost sales and revenue from website downtime: $142,500

Incident Response Expenses:
IT forensics firm: $22,000
Legal consultation fees: $15,000
Incident Response Manager fees: $6,000

Total Cost: $226,500

Learnings

As the use of IoT devices increase, Distributed Denial of Service (DDoS) attacks are becoming more common and more powerful.

To minimise the impact of an incident like this, it is important to build a business continuity plan that ensures critical business applications, systems, and activities do not rely on only one single IT provider.

Chubb’s incident response managers and trusted Cyber vendors are experienced in dealing with DDoS attacks and can assist in getting SME businesses back on track as soon as possible.

Case Study 2: Staff Negligence

An employee at a hardware store ignored internal policies and opened a seemingly innocuous file attached to an email. The next day the hardware store’s stock order and cash registers started to malfunction and business trade was impaired as a result of the network failing.
 

Financial Impact

Recovery Costs:
Increased staff costs to restore network to functioning order: $18,000

Business Interruption:
Lost sales and revenue from business interruption: $50,000

Incident Response Expenses:
Forensic investigation and response services: $100,000
Incident Response Manager fees: $10,000

Total Cost: $178,000

Learnings

This case study underlines the importance of training staff to be vigilant of cyber threats. The best ways to establish positive and secure habits within your company’s workforce is with regular training and education.

You should also restrict access to sensitive information by only allowing management or those who require that information for company operations, to have access.