With the multitude of ransomware attacks that have been in the news recently, we’ve been receiving various questions surrounding this topic.  So, we wanted to clear up any confusion on this topic.

First of all, what is ransomware?

As the name suggests, it is software that can hold your individual computer or your business’ entire system for ransom.  A cyber thief will take control of your network and not relinquish control until you have paid the requested amount.

According to Chainanalysis, which is a blockchain research firm, ransomware attacks are up over 340% in the past year.  Over $400 million dollars have been paid in ransoms.

The average ransom amount has been on the rise over the past few years.  In 2021, the average ransom requested is over $50,000.

Naturally, this leads us to the question of “How does ransomware get on your computer or in your network?”

The most typical way hackers accomplish this is via phishing emails.  These emails will pretend to be from an authoritative entity, like your bank or PayPal.  In reality, they are just posing as them and hoping to get you to enter your username and password into an online form that they created.

Now, according to security company SecureAuth, more than 50% of people use the same password for multiple accounts.  Thus, if a hacker can get one username and password combination from you, there’s a 50% chance that it can be used for all accounts that are associated with you.

Another common way that a ransomware attack occurs is through tricking you or your employees into downloading a piece of malicious software.  The download could appear to be a pdf or some other innocuous file type.  Once it’s in your system, it works like a virus.  It will lock everyone out and demand a payment.

What happens if you refuse to pay?

If you choose not to pay the ransom, there are a few different scenarios that could happen.

Scenario 1 – They move onto the next victim.  This is the best-case scenario and leaves you in a position of having to restore your system.

Scenario 2 – They discover that you won’t pay, so they leak private information about you or your clients online.  Depending upon what type of data you store, this could prove to be a huge blow to your reputation.

Scenario 3 – They discover that you won’t pay, so they decide to make their money a different way.  They sell the private data of you and your clients on the dark web.  Again, depending upon what type of data you have, they could make more money this way than if you decided to pay.

So, how can you protect yourself and your business from this type of attack?

There are 5 very clear steps for you to take to accomplish this goal.

Step 1 – Make sure that your entire system is backed up nightly offsite and off-network.  You should retain at least 2 weeks of full backups (or a month if you have the digital space).  This way, if the code doesn’t attack right away, you have the option of multiple data sets.

Step 2 – Have a plan in place for restoring from a backup in 24 hours or less if possible.

Step 3 – Train your employees to recognize cyber threats in all forms.  There are many cyber training programs available that will send tips, tricks and quizzes on a monthly basis.

Step 4 – Keep your antivirus and firewall software up to date.  You will see some added protection if you get your employees to use a VPN as well.

Step 5 –No system is impenetrable and many times, human error is the cause.  Purchase a standalone cyber insurance policy to guard against this.  Most cyber insurance policies cover this type of attack and provide the support to get you back up and running smoothly.

Have questions about any of these steps or how to purchase a cyber policy?  Contact INF at 412.563.2106.  We can get you a policy in less than a week!

No one likes to report a legal malpractice claim to their carrier. It reminds us that we made a mistake or that very difficult client that is impossible to satisfy.

To make matters worse, legal malpractice policies demand that we also report any potential claims, not just actual claims, but those issues that may develop into an actual claim.

All claims, whether actual claims or potential claims must be reported to the carrier as soon as you become aware of them. Don’t delay this process. Slow reporting to the carrier can and will cost you money in that the carrier can simply deny your claim because the claim wasn’t timely reported. Proper notice must be given to the carrier.

A good tip is to review your policy and make sure you’re familiar with the reporting process. Making that call or writing that letter may be painful and dredge up a few bad memories or two, but it will provide a level of comfort knowing that the report was made and the denial of coverage is not in the cards for late reporting.

Having trouble getting gas recently? I think we’ve been pretty fortunate in Pennsylvania in that the pipeline shutdown did not hit us too badly.

It does, however, drive home the point that if you haven’t purchased a standalone cyber policy, or at least considered it, you should. Cyber attacks have been on the rise in all sizes and types of industries and professions.

Some of the legal malpractice policies, perhaps even yours may include cyber coverage. Although it is a nice feature and benefit to have in the policy, it usually is nowhere near enough coverage. The limits are usually sub limits lower than your aggregate policy limit. The coverage is limited in scope, and it can dilute the insuring agreement.

Don’t get me wrong. Any added benefits in your insurance policy is usually a good thing. But don’t depend on ancillary coverage to protect your firm and your clients data. You should look into obtaining a standalone cyber policy.

I’m starting a small business. What insurance do I need? 

When starting a small business, most of the time, money is pretty tight and price is a major consideration when deciding to buy anything. Usually, and unfortunately, insurance is pretty much always close to the bottom of the list. 

At a bare minimum, you do need to consider the purchase of any insurances that are mandated or required by the state that you’re in, and the industry that you’re practicing in. 

In my opinion, the most common required insurance in Pennsylvania is workers compensation. If you have employees, you need a workers compensation policy to cover them in the event that they are injured on the job. You should have this in place on the day you open up shop. 

Next, you should think about protecting yourself and the assets of your business. This can usually be accomplished with the purchase of a business owners package, which would include general liability coverage and coverage on the business personal property. 

General Liability protects you against negligence claims, and the business personal property actually protects the property of the business. Depending on the amount in your specific industry, these small business packages can be purchased starting at $500. 

Again, a lot goes into pricing and the pricing will vary. There are several other coverages that you need to consider and review, such as employee benefits, health insurance, professional liability insurance, cyber insurance, bonds, and crime policies, just to name a few.

But if you’re just starting out, you need to make sure you address the first three items that we talked about – workers compensation and a small business owners package which protects in general liability, and business personal property.

When underwriters look at a risk, there are several factors that come into play in the pricing portion of the process.

A couple of the major driving factors or driving forces are:

• How long have you actually carried insurance?
• How long have you actually been practicing law?
• What type of law do you practice?
• What areas do you play in?
• Have you ever had a legal malpractice claim?
• Do you really care about risk management?
• What kind of risk management techniques do you have in place in your office?

These are all things that an underwriter will look at that will either cause your premium to go up or cause your premium to go down.