CPA Canada hit by cyberattack affecting data of more than 329,000

TORONTO _ A cyberattack on the Chartered Professional Accountants of Canada website has affected the personal information of more than 329,000 members and stakeholders, the organization said.

The information includes names, addresses, emails and employer names, but passwords and credit card numbers were protected by encryption, CPA Canada said.

It warned the data could be used in email phishing scams and encouraged those affected to  “remain vigilant.”

The attack by  “unauthorized third parties” occurred between Nov. 30 and May 1, according to an internal investigation carried out with the help of cybersecurity experts.

The organization said it beefed up its security measures and contacted the Canadian Anti-Fraud Centre and privacy authorities after learning of “a possible security incident” the week of April 20.

“Upon discovering this, CPA Canada took immediate steps to secure its systems and conduct a thorough analysis to determine what information may have been involved,” the group said in an email.

“There is no evidence that the encryption keys were affected in this incident and we have no reason to believe the encryption was compromised.”

The personal information relates mainly to the distribution of CPA Magazine and everyone affected has been notified, the organization said.

Hacks against a wide range of companies since 2018 have included medical test laboratory LifeLabs and credit union Desjardins, which combined saw the theft of the personal information of more than 19 million Canadians.

 

COALITION RAISES $90 MILLION IN FUNDING TO BUILD THE FUTURE OF CYBER INSURANCE

Existing investor Valor Equity Partners led Series C round; largest ever cyber insurance funding round

SAN FRANCISCO — May 20, 2020 — Coalition, the leading cyber insurance and security company, today announced it has raised $90 million in equity capital to fuel its mission to solve cyber risk, and support its rapid growth and global expansion. Valor Equity Partners led the funding with participation from Felicis Ventures, Greyhound Capital, and Coalition’s existing investors.

The investment comes as the company’s customer base crosses 25,000 — a 600% increase from the prior year — making it one of the largest providers of cyber insurance and security in the United States. Coalition’s unique product offerings combine best-in-class insurance and proactive cybersecurity tools to help keep businesses safe. Cyber losses cost the global economy upwards of $1.5 trillion each year, and yet the majority of businesses are under-insured and under-prepared to manage and mitigate the risks of an increasingly digital world. Coalition is addressing this gap by providing no-cost cybersecurity tools to prevent losses, security and incident response services to contain them, and comprehensive cyber insurance to help organizations recover from failures and breaches.

“Cybersecurity isn’t a technology problem, it’s a risk management problem,” said Joshua Motta, Founder and CEO of Coalition. “Traditional cybersecurity technology such as firewalls and antivirus were designed to protect networks, not businesses. Coalition protects an entire business by offering cybersecurity-as-a-service without any additional hardware or software, security and incident response services, and comprehensive insurance cover of up to $15 million.”

The announced funding will help Coalition target three key areas:

Cybersecurity Access: once accessible only to national governments and large enterprises, Coalition will continue to make available, at no cost, state-of-the-art cybersecurity capabilities to small and midsize businesses. Coalition’s small and midsize policyholders experienced claims that cost an average of $160,000 — an expense that few businesses can afford to bear. “Businesses need more protection than traditional insurers can offer, including help preventing incidents from happening in the first place, and support during and after a crisis,” said Vivek Pattipati, Partner at Valor Equity Partners. “We believe Coalition will be as disruptive to the cybersecurity industry as it has been to the insurance industry.”

International Expansion: cyber risks know no boundaries, and Coalition plans to make its offerings available globally starting with Canada. “As the entire world becomes increasingly digital, Coalition has a tremendous opportunity to address the real risks that cyber poses across many markets,” said Pogos Saiadian, Partner at Greyhound Capital.

New Products: Coalition plans to develop additional insurance products to address a new range of threats technology brings to both tangible and intangible assets — many of which are not well covered by traditional insurance policies. “The future of cyber insurance is in integrated solutions to protect against cyber incidents across all asset types,” said Sundeep Peechu, Managing Director at Felicis Ventures. “Coalition is uniquely positioned to challenge the status quo of insurance by unraveling the complexity of modeling and pricing cyber as a peril.”

Antonio Gracias, Founder and CEO of Valor Equity Partners said: “We view Coalition as a category-defining company that is fundamentally changing the way organizations engage with insurance. Coalition is one of the fastest growing insurance technology companies despite raising a fraction of the capital of its peers.”

In total, Coalition has raised $125 million in equity funding from investors, including Vy Capital, Ribbit Capital, Hillhouse Capital, Valor Equity Partners, and Greenoaks Capital, among others. All existing investors participated in Coalition’s latest round of funding.

To learn more about Coalition, visit coalitioninc.com.

Coalition is the leading provider of cyber insurance and security, combining comprehensive insurance and proactive cybersecurity tools to help businesses manage and mitigate cyber risk. Backed by leading global insurers Swiss Re Corporate Solutions, Lloyd’s of London, and Argo Group, Coalition provides companies with up to USD $15 million of cyber and technology insurance coverage in all 50 states and the District of Columbia, as well as CAD $20M of coverage across all 10 provinces in Canada. Coalition’s cyber risk management platform provides automated security alerts, threat intelligence, expert guidance, and cybersecurity tools to help businesses remain resilient in the face of cyber attacks. Headquartered in San Francisco, Coalition has presences in New York, Los Angeles, Chicago, Dallas, Washington DC, Miami, Atlanta, Denver, Austin, and now Vancouver and Toronto.

Cyber Insurance In The Covid-19 Landscape

Cyber Insurance In The Covid-19 Landscape

Gowling WLG

With the unprecedented global pandemic of Covid-19, companies are adapting to the new reality of social distancing and self-isolation practices encouraged by our government and health authorities, leading many businesses to transition large numbers of employees to remote working. Many of these employees have no prior experience working remotely, and in some cases, may not be properly equipped to do so.

Remote working requires, among other things, equipping employees with the ability to connect to company servers from home. This transition requires furnishing employees with the tools required to carry out their work efficiently, such as providing them with laptops, at home workstations, and remote access to secured networks and other company resources.

Unfortunately, the transition to working remotely almost certainly will mean increased risk of cyber attack and cyber losses. Cyber risks faced by businesses today take different forms. In addition to hardware and/or software failure, the loss of portable devices such as laptops or smart phones, and the use of unsecured Wi-Fi connections by employees, companies face sophisticated attacks from hackers targeting users seeking information on Covid-19.

Given these risks, it is critically important businesses take steps to insure and protect themselves against cyber losses.

Cyber Insurance-What is it and What Does It Cover?

Cyber insurance provides protection and coverage for the security and privacy of digital information and losses resulting from data breaches.

Cyber risk policies provide both first party and third party coverage. Cyber insurance may take the form of a stand-alone policy or be made available by way of endorsement to a D&O or E&O liability policy. Though each policy varies, and a policy should be thoroughly reviewed prior to purchase, first party coverages typically provided under a cyber insurance policy include:

  • expenses incurred by a company as a direct result of the breach, including remediation and notification expenses, as well as crisis management expenses; and
  • resultant costs such as business interruption and loss of goodwill.

Third party coverage under a cyber insurance policy typically provides coverage for liability in connection with losses suffered by customers as a result of the theft and use of their personal and/or financial data.

Most insurers also offer value-added services, such as network security testing, designed to help companies avoid and mitigate the effects of a data breach, and crisis management services.

Ensure That Your Cyber Insurance Policy is Comprehensive Enough to Suit Your Company’s Needs

Coverages offered under cyber insurance policies vary considerably. When purchasing a cyber insurance policy, the policy wording, and especially the exclusions, should be reviewed with a professional to ensure the potential loss events your company may face in the event of a data breach are covered. The type of coverage required will depend on the nature of the company, the types of information it stores within its secure network, as well as the types of activities the business participates in.

What Can Employees and Employers Do to Prevent Cyber Attacks?

Both employers and employees must take utmost care to protect themselves as well as confidential company information, especially while working remotely. Such steps include:

  • Encouraging employees to pay attention to phishing emails, which are emails disguised with an enticing link, that when clicked on, can download malware onto a device and the company’s systems;
  • Ensuring employee devices are up to date on their anti-virus protection;
  • Ensuring employees are working on secure, password-protected internet connections and reducing the use of public Wi-Fi as much as possible;
  • Reminding employees personal email should not be used for any company business; and,
  • Urging employees to keep track of what they are printing at home and to shred confidential documents as soon as possible before they are disposed of.

Conclusion

The best way to protect your company from cyber risks is to ensure appropriate preventive measures are in place and employees working from home or with remote access to company data are trained on how to implement these measures. We must all be diligent in protecting and securing sensitive business data and client information. However, when an attack does happen, it is crucial to have the right cyber risk insurance products in place to assist in dealing with the after-effects of a breach.

Read the original article on GowlingWLG.com

The content of this article is intended to provide a gener

Source: Mondaq

Aon, announced the acquisition of Cytelligence Inc, a Canadian-based cyber security firm

The acquisition combines Aon’s industry-leading investment in cyber security with Cytelligence’s unique technical expertise in incident response and digital forensics services to strengthen Aon’s cyber security client value proposition 

CHICAGOFeb. 4, 2020 /CNW/ — Aon plc (NYSE: AON), a leading global professional services firm providing a broad range of risk, retirement and health solutions, announced today the acquisition of Cytelligence Inc, a Canadian-based cyber security firm that provides incident response advisory, digital forensic expertise, security consulting services and cyber security training for employees to help organizations respond to cyber security threats and strengthen their security position.

The acquisition will help Aon expand its current coverages within the cyber market at a time when cyber claims are almost doubling year-over-year. The 2019 Cybersecurity Almanac published by Cisco and Cybersecurity Ventures predicts that cyber events will cost $6 trillion annually by 2021, as companies are digitizing most of their processes and are often operating remotely. Global cyber insurance premiums are expected to grow from $4 billion in 2018 to $20 billion by 2025. According to Aon’s 2019 Global Risk Management Survey, cyber-attacks were identified as a top ten risk facing organizations and is predicted to be one of the top three risks for organizations in 2022.

“As the number of network intrusions, data breaches, ransomware attacks, and similar threats continues to increase in both frequency and severity, expertise in cyber incident response becomes critical to organizations and insurance companies,” said J Hogg, CEO of Aon’s Cyber Solutions. “The Cytelligence team are deep experts in cyber incident response, ransomware mitigation, and cyber security training for employees, which will help cement our position in both North America and globally as an industry leader.”

Cytelligence will join the growing portfolio of Aon’s Cyber Solutions, which combines digital risk management services, security services, professional risk solutions, and a global risk consulting practice. This acquisition enhances Aon’s 2016 acquisition of Stroz Friedberg and now allows Aon’s Cyber Solutions to offer an even more holistic portfolio of services to clients from proactive security services, to incident response, to risk quantification and insurance broking.

“Together, we will deliver complete proactive solutions from risk assessment, cyber risk policy underwriting to secure insurance coverage to protect critical assets, to cyber breach response, effective and efficient cyber incident remediation, meticulous data collection and data preservation,” said Daniel Tobok, CEO of Cytelligence. “Put simply, everything that is connected to the internet can be compromised. proactive companies and their Boards are preparing now with proactive actions with penetration testing, vulnerability assessments, security audits, and training of their employees.”

Cytelligence has offices in TorontoOttawaNew YorkSan Francisco and Miami. The firm employs professionals in cyber security and education, investigations, and forensic analytics. The firm was founded in June 2016.

Mr. Tobok will join Aon as the Canadian President, Aon’s Cyber Solutions.

About Aon
Aon plc (NYSE:AON) is a leading global professional services firm providing a broad range of risk, retirement and health solutions. Our 50,000 colleagues in 120 countries empower results for clients by using proprietary data and analytics to deliver insights that reduce volatility and improve performance.

About Cytelligence
Cytelligence is a leading international cyber security boutique with deep expertise in Cyber Breach Response, Cyber Breach Investigations, and Digital Forensics. We are known for our technique: well planned, well executed and detailed-oriented engagements. Our Offensive Security Consulting includes: Penetration Testing, Vulnerability Assessments, Security Audits, and Secure Development Lifecycle Management, including code reviews.

SOURCE Aon plc

Canadian insurance company lost nearly US$1M in ransomware attack

The excerpted article was written by Ryan Flanagan CTVNews

TORONTO — Computers at a Canadian insurance company were disabled for more than one week due to a ransomware attack that resulted in a payout of nearly US$1 million.

The attack happened last October, but is only coming to light now as efforts to reclaim the ransom make their way through the British court system.

The U.K. court action is being led by a British insurance firm with which the Canadian company had a policy protecting it against suffering losses from cyberattacks.

Neither company is named publicly in the lawsuit the British company has filed against the unknown attackers. In a court decision made last month and published Jan. 17, Justice Simon Bryan ruled that hearings in the case would be held in private and that the involved insurance companies’ names would not be published, saying anything else would open the insurance companies up to retaliatory and copycat attacks while also potentially giving the hackers a chance to cover their tracks.

“Publicity would defeat the object of the hearing,” Bryan wrote.

COMPANY TURNED OVER US$950,000

According to Bryan’s written decision, the hacker or hackers somehow “managed to infiltrate and bypass the firewall of [the Canadian company].” From there, they encrypted files on the company’s servers and locked desktop computers. They also left a note.

“Hello [company name] your network was hacked and encrypted. No free decryption software is available on the web. Email us … to get the ransom amount. Keep our contact safe. Disclosure can lead to the impossibility of decryption. Please use your company name as the email subject,” the message read.

The Canadian company got in touch with its British insurer, which hired ransomware response specialists. The hacker told the specialists they were demanding US$1.2 million in Bitcoin, but eventually agreed to US$950,000 “as an exception.”

The specialists then transferred 109.25 Bitcoin – roughly equivalent to US$950,000 at the time – of the British company’s money to the specified account. Although they had been promised a quick response, nearly 16 hours elapsed before the hacker got in touch again, giving them a decryption program.

Even with the program, it took five days to run the program on each of the company’s 20 servers and five more to decrypt and unlock all 1,000 desktop computers.

Some of the Bitcoin was sold for other currency before specialists were able to locate it, but the bulk of the ransom – 96 Bitcoin – was traced to one specific account on one specific exchange.

The British company is suing the hacker as well as the owner of the account – it’s not certain if they’re the same person or not – as well as the Bitcoin exchange. The insurance firm is seeking a court order to force the exchange to reveal the identity of the account owner.

A RISING THREAT

The Canadian Anti-Fraud Centre (CAFC) described ransomware last September as “an increasingly common threat, targeting everyone from individuals and small businesses to large private enterprises and government organizations.”

There have been several high-profile cases in Canada in recent years, including an attack that paralyzed the Nunavut government’s computers for nearly two weeks last November.

Insurance companies are also known targets. One of the largest insurers in Oman was reportedly hit earlier this month. In Canada, Andrew Agencies Ltd. was targeted last fall but said it did not pay a ransom – implying that they are not the Canadian company at the centre of the British case.

The CAFC notes that there is no way to completely safeguard against these attacks, but says training employees to recognize cybersecurity threats, restricting access to computer administrative privileges and storing backup data offline can help protect an organization.

Source: CTV News

 

 

Mastercard to open $510M cyber-security centre in Vancouver

The excerpted article was written by Tyler Orton Business in Vancouver

Ottawa is putting up nearly $50 million to boost the presence of Mastercard Inc. in Vancouver with the launch of a $510 million cyber security centre.

The credit card company announced Thursday (January 23) that the West Coast city would be the home of its sixth global technology centre — one focused on developing technologies to thwart cyber attacks in the payments arena.

In a bid to entice the financial giant to B.C., the federal government dipped into its Strategic Innovation Fund to the tune of $49 million.

A February 2019 analysis from The Logic revealed just over half the fund’s recipients were foreign firms, at the time the story was published.

Mastercard CEO Ajay Banga said in a statement, “The Vancouver centre will help us meet the growing demand for technology solutions to reduce the cost of cyber-attacks, enable today’s connected devices to become tomorrow’s secure payment devices and address the growing vulnerabilities associated with the Internet of Things.”

Mastercard’s new Intelligence and Cyber Centre will be based at The Exchange office tower on Howe Street, which counts Amazon.com Inc. among its tenants.

The Mastercard office houses Vancouver-founded cyber security firm NuData Security Inc., which Mastercard acquired in 2017.

Mastercard said in a statement the new centre will be “creating and maintaining” a total of 380 jobs, while the federal government estimated the new sit would create 100 new co-op positions.

NuData already employs about 100 workers in its downtown office, leaving Mastercard to hire about 300 more workers to meet the needs of the cyber centre.

Jill Tipping, CEO of the B.C. Tech Association, told Business in Vancouver Mastercard was clearly enticed by access to talent and the city’s connections with key markets around the world.

“I’m thrilled that they’re recognizing Vancouver as a great place to launch, but it makes it even more important that we put the investment into supporting our local homegrown companies,” she said.

Mastercard is the most recent international company to show an interest in Vancouver.

Earlier this week, Silicon Valley-based fintech company Tipalti Inc. announced it was opening an office in the city next month, while fellow California tech firm Grammarly Inc. opened a 3,000-square-foot site in Gastown last fall.

READ FULL ARTICLE HERE: 

Subscribe To Our Newsletter

Join our mailing list to receive the latest news and updates from ILSTV

You have Successfully Subscribed!

Pin It on Pinterest