TLDR
-
No business is too small to be a target for cyber crime. Many attacks are automated, allowing criminals to cast a wide net and target thousands of businesses at once.
-
Most incidents result from common gaps: human error, outdated software, weak passwords and unsecured remote connections.
-
Having an incident response plan can keep a disruption from turning into a crisis.
-
While it may be tempting to handle a cyber attack quietly, reporting it could help minimize damage and protect others.
Has your business been a target of cyber crime? From simple phishing emails to sophisticated business email compromise scams, chances are your business has encountered at least one fraud attempt.
Why are small businesses vulnerable to cyber crime?
Smaller organizations are attractive targets of cyber crime because they’re easy to reach with automated technology. The same phishing email, stolen password and software bug can be tried against several companies at once – and smaller organizations tend to have fewer layers of security with which to defend themselves.
Many smaller companies deal with similar conditions:
-
A smaller security budget: Security competes with many other things – and when the choice is between a new hire, new equipment or a security upgrade, security may not get the funding.
-
Consumer-grade tools are doing business-grade work: Many small businesses run the same antivirus software and password habits at work that they use at home. While this may be sufficient for personal use, it may not be robust enough for an organization handling payroll, client records and supplier payments.
-
A lack of staff training: Employees are the first line of defence against many types of fraud, but if they don’t know how to spot a spoofed invoice or a fake vendor email, they can be easily tricked.
-
A belief that ‘small’ means ‘safe’: News about cyber attacks tends to feature major corporations, with many entrepreneurs believing that the larger the company is, the more likely it is to be hacked. The reality is, however, that collecting smaller amounts from more businesses can be easier than going after one large company with the resources to defend itself.
Where do cyber criminals look for a way in?
Cyber criminals tend to look for the same handful of openings:
| Weak spot | The threat it opens the door to | What it can look like |
| Human error | Phishing and social engineering, including business email compromise, bank impersonation and investment scams | You or an employee clicks a malicious link or attachment in an email that appears to come from your bank, a colleague or a supplier, pressing for an urgent transfer, a login or a one-time passcode. |
| Outdated software | Unpatched software vulnerabilities | An attacker exploits a documented flaw in a program your business hasn’t updated. |
| Weak or reused passwords | Account takeover; may be followed by ransomware | Login credentials are compromised and used to sign into your systems; fraudsters may then encrypt your files and demand payment. |
| Unsecured remote connections | Ransomware and data theft | You or an employee works from a personal device or public network, giving an attacker an unmonitored route into your systems |
| Trust in familiar contacts | Third-party and supply chain risk | A message from a supplier’s email address advising of a change in payment details for an invoice you were expecting |
How can your business prepare for a cyber incident?
As most businesses will encounter some form of cyber incident, it makes sense to have an action plan in place for when it does happen. Preparation can make the difference between a manageable incident and a crisis that disrupts operations for an extended period of time.
You don’t need a security team to prepare. Rather, these straightforward steps can reduce both risk and damage:
-
Assign clear roles. Designate responsibilities upfront, even if you’re a one-person shop or have a few employees. You’ll need to consider how to handle IT, legal, operations and communications.
-
Plan for common scenarios. Think through likely threats like ransomware, phishing or data breaches and write down step-by-step actions for each scenario. This “dry run” reduces panic if the real thing happens.
-
Keep contacts updated. Maintain a current list of critical contacts, including your clients, partners, regulators, IT provider and bank. Knowing who to reach and how can make a fast, transparent response possible.
-
Test and revisit the plan. Cyber threats evolve, and so should your plan. Consider reviewing your plan once a year to keep it relevant and usable.
What prevention measures should you put in place?
A response plan tells you what to do once something has gone wrong. Strong security habits are key to minimizing risk.
-
Install security tools and keep software up to date. The right anti-virus or anti-malware tools can help guard against malicious attacks. Applying updates and patches regularly can help close security gaps and improve system resilience.
-
Create strong, unique passwords for all login credentials. If one password is stolen or compromised, maintaining unique passwords help stop scammers from accessing all your accounts.
-
Back up your files regularly (ideally both in the cloud and offline). This ensures you can recover critical information should your business be a target of a ransomware or malware attack.
-
Install a Domain Name System (DSN) firewall. Firewall software can protect your business network from malicious internet traffic, as firewalls scan network traffic and block unwanted traffic from affecting your network.
What to do after a cyber incident
How you respond in the first few hours can determine how much an incident ends up costing you.
If your business experiences a cyber attack, taking these steps can help limit the impact on your business.
-
Notify your bank. Affected accounts and company cards can be locked, monitored and replaced quickly, and fraud specialists can guide you through what comes next. Clients can call RBC, visit a branch or contact their branch or account manager directly.
-
Alert credit reporting agencies. Contact both Equifax and TransUnion – they operate independently and may not share information. A fraud alert on your file makes it harder for anyone to open accounts in your business’s name, and it’s worth requesting your credit report to review it for unfamiliar activity.
-
Contact law enforcement and anti-fraud agencies. Reporting a cyber attack to authorities can help ensure you get the support your business needs to respond. Local or federal law enforcement can coordinate a response and collect evidence.
Cyber threats are a reality for businesses of every size – but they don’t have to become a crisis. Closing key gaps and mapping out a response plan can put your business in a more confident, secure position.
For a full business protection checklist, detailed scam breakdowns and a complete reporting directory for Canada, the U.S. and the U.K., download the Digital Safety and Scams: Business Edition booklet.
FAQs
Contact your bank right away so affected accounts and company cards can be locked, monitored and replaced. From there, alert both credit reporting agencies to place a fraud alert on your business’s file and report the incident to local law enforcement and anti-fraud agencies. Having those contacts documented in advance can make a fast response possible.
In many cases, yes. Under federal privacy law, organizations must report breaches that create a real risk of significant harm and notify the individuals affected. Businesses are also required to keep records of every breach, whether or not it meets the reporting threshold. International rules and sector-specific obligations may apply on top of that, so it’s worth confirming what applies to your business before an incident happens.
Requests to change payment date, details, etc. should be questioned – particularly when they arrive with urgency or a request for confidentiality. It’s best to verify the change through a channel you already have – such as a contact number you’ve used before, not the one provided in the message. A best practice is to have a standing rule that every change to payment instructions gets confirmed by phone.
This article is intended as general information only and is not to be relied upon as constituting legal, financial or other professional advice. A professional advisor should be consulted regarding your specific situation. Information presented is believed to be factual and up-to-date but we do not guarantee its accuracy and it should not be regarded as a complete analysis of the subjects discussed. All expressions of opinion reflect the judgment of the authors as of the date of publication and are subject to change. No endorsement of any third parties or their advice, opinions, information, products or services is expressly given or implied by Royal Bank of Canada or any of its affiliates.
