I remember not that long ago at Christmas time, we used to go shopping at the mall and we were always worried about someone breaking into our cars and stealing the gifts we just purchased.  We had to make sure that when we went back out to the car to put the gifts away so we could continue shopping, that we put the packages in the trunk or worse yet put them in the back seat and cover them up with a blanket or something else.  

Although I still think you have to be careful at the mall, most of us shop online and we have different types of worries, online and cyber threats.  Be careful when you’re shopping online, make sure you’re on a secure site when checking out, to who and when you provide your confidential information and be wary of bounceback emails advising you that your credit card was rejected or not recognized and you need to re-enter it. 

I know you have heard it a million times, BUT be careful with your confidential information.  The hustle and bustle is still a big part of the holidays, it is both online and at the shopping malls….be alert, don’t let someone steal your purchases from your car or your computer!

Do you have a real estate title agency or an arbitration mediation company? Did you know that these types of companies can be added to your legal malpractice insurance policy as an additional insured?

Adding them to your legal malpractice policy can be a cost effective method of ensuring that entity against malpractice insurance claims. All carriers have some requirements that the entity must satisfy, but usually those requirements are few.

One requirement that seems to be at the top of all the carrier’s lists is that the entity must be 100% owned by either the firm or the members in the firm. If it is not 100% owned by the firm or the members, the entity cannot be added as an additional insured.

So if you’re in this situation and looking for coverage for that separate entity, consider adding the entity as an additional insured to your legal malpractice policy. It is not a bad option. 

It seems like we are getting back to some kind of normalcy with more and more people going back to the office. However, there are still many people working from home.

If you’re in this situation and you have an employee working from home, don’t let your guard down. From a risk management perspective, that person still needs to be supervised, have adequate protection on the computer, printer and scanner that they are using from home.

If they’re remotely accessing your system, make sure their passwords are strong and are changed on a routine basis.

Regular meetings should be conducted by telephone and or zoom type calls. This helps keep everyone connected and on the same page when it comes to the firm’s workflow and processes.

These meetings don’t have to be hours long, nor do they have to be every day, but they should be completed on a consistent and routine basis. So no one gets left behind in the workflow.

Hopefully, this soon will all be a distant memory and we will be back in that office routine. But until then, again, don’t let your guard down when it comes to your offices and your clients’ protection.

With the multitude of ransomware attacks that have been in the news recently, we’ve been receiving various questions surrounding this topic.  So, we wanted to clear up any confusion on this topic.

First of all, what is ransomware?

As the name suggests, it is software that can hold your individual computer or your business’ entire system for ransom.  A cyber thief will take control of your network and not relinquish control until you have paid the requested amount.

According to Chainanalysis, which is a blockchain research firm, ransomware attacks are up over 340% in the past year.  Over $400 million dollars have been paid in ransoms.

The average ransom amount has been on the rise over the past few years.  In 2021, the average ransom requested is over $50,000.

Naturally, this leads us to the question of “How does ransomware get on your computer or in your network?”

The most typical way hackers accomplish this is via phishing emails.  These emails will pretend to be from an authoritative entity, like your bank or PayPal.  In reality, they are just posing as them and hoping to get you to enter your username and password into an online form that they created.

Now, according to security company SecureAuth, more than 50% of people use the same password for multiple accounts.  Thus, if a hacker can get one username and password combination from you, there’s a 50% chance that it can be used for all accounts that are associated with you.

Another common way that a ransomware attack occurs is through tricking you or your employees into downloading a piece of malicious software.  The download could appear to be a pdf or some other innocuous file type.  Once it’s in your system, it works like a virus.  It will lock everyone out and demand a payment.

What happens if you refuse to pay?

If you choose not to pay the ransom, there are a few different scenarios that could happen.

Scenario 1 – They move onto the next victim.  This is the best-case scenario and leaves you in a position of having to restore your system.

Scenario 2 – They discover that you won’t pay, so they leak private information about you or your clients online.  Depending upon what type of data you store, this could prove to be a huge blow to your reputation.

Scenario 3 – They discover that you won’t pay, so they decide to make their money a different way.  They sell the private data of you and your clients on the dark web.  Again, depending upon what type of data you have, they could make more money this way than if you decided to pay.

So, how can you protect yourself and your business from this type of attack?

There are 5 very clear steps for you to take to accomplish this goal.

Step 1 – Make sure that your entire system is backed up nightly offsite and off-network.  You should retain at least 2 weeks of full backups (or a month if you have the digital space).  This way, if the code doesn’t attack right away, you have the option of multiple data sets.

Step 2 – Have a plan in place for restoring from a backup in 24 hours or less if possible.

Step 3 – Train your employees to recognize cyber threats in all forms.  There are many cyber training programs available that will send tips, tricks and quizzes on a monthly basis.

Step 4 – Keep your antivirus and firewall software up to date.  You will see some added protection if you get your employees to use a VPN as well.

Step 5 –No system is impenetrable and many times, human error is the cause.  Purchase a standalone cyber insurance policy to guard against this.  Most cyber insurance policies cover this type of attack and provide the support to get you back up and running smoothly.

Have questions about any of these steps or how to purchase a cyber policy?  Contact INF at 412.563.2106.  We can get you a policy in less than a week!

Having trouble getting gas recently? I think we’ve been pretty fortunate in Pennsylvania in that the pipeline shutdown did not hit us too badly.

It does, however, drive home the point that if you haven’t purchased a standalone cyber policy, or at least considered it, you should. Cyber attacks have been on the rise in all sizes and types of industries and professions.

Some of the legal malpractice policies, perhaps even yours may include cyber coverage. Although it is a nice feature and benefit to have in the policy, it usually is nowhere near enough coverage. The limits are usually sub limits lower than your aggregate policy limit. The coverage is limited in scope, and it can dilute the insuring agreement.

Don’t get me wrong. Any added benefits in your insurance policy is usually a good thing. But don’t depend on ancillary coverage to protect your firm and your clients data. You should look into obtaining a standalone cyber policy.