The chief executive of a cybersecurity company has urged Irish businesses to get an external check on their IT security, with many being forced to pay ransoms to retrieve their data.
Kevin O’Loughlin, CEO of Nostra, said the risk of cyberattacks on Irish businesses and government agencies is at an all-time high.
Mr O'Loughlin told BreakingNews.ie that a lot of companies "have a view that they are in a good place and secure", when they actually have vulnerabilities.
He said relying on self-assessments of IT infrastructure is "never a good idea," adding: "What we're seeing is the more specific targeted attacks are happening, and we're seeing people being manipulated into allowing bad actors access to systems. That's the most common current threat."
A lot of companies try to deal with it internally, pay the ransom, that's certainly common.
Mr O'Loughlin added: "A lot of companies try to deal with it internally, pay the ransom, that's certainly common. In some instances you have a choice to make, either I pay the ransom or close my business because if you've lost all of your data that can happen."
He explained that cyberattacks are constantly becoming more sophisticated, with hackers now first moving to erase a business' backup data.
"We're seeing lots of organisations saying 'well, we have a backup if we're attacked', but the reality now is they attack the backup first, and then they attack the system. Then you're left in a situation where you either pay the ransom or can you recover? You don't know what invoices have been sent out, who you've paid or has paid you, your payroll, it can be so damaging."
Mr O'Loughlin said hackers will often target companies at weekends.
"The most common time we're seeing for attacks is 6.30pm- 7pm on a Friday night. They get in and have a full weekend before anyone notices there is a problem, and they can do an awful lot of damage in that time.
"The bottom line is if you get the basics right, you're massively reducing the risk of an attack. The basics are having all of your patches for Windows and different systems up to date, an off-site backup, good antivirus, good firewalls."
He said two-factor authentication is crucial for all accounts and password.
"Without two-factor authentication on an email account the risk of breaches is enormous, probably upwards of 5 -10 per cent of email breaches have been hacked without this in place, you often wouldn't even realise it had happened.
"They download a copy of your email and then sift through it to find information that can be used against you. An invoice, they might get on to your customers and say you've changed your bank details, if they get in at any level of organisation there is information they can sell online leading to a greater attack down the road.
"A lot of people are not even aware their data has been stolen."
Most people who suffer a significant breach were not aware the day before that they had a vulnerability.
He explained that a lot of the organisations targeting businesses in Ireland and elsewhere set up very professionally.
"You have to remember these are not people sitting in a bedroom, these are offices with 400 people spending all day every day trying to attack organisations with customer service to help you get your data back if they catch you, and you pay the ransom.
"These are proper, big organisations generating billions at the expense of others.
"Most people who suffer a significant breach were not aware the day before that they had a vulnerability. Often when we go in and look we find they were massively exposed, and we could have helped with that if we were there before."
He advised all business owners, no matter how secure they think their organisation is, to get an external check.
"An external assessment is key. It's not fair to ask your internal IT department to assess all the technology and point out the flaws. We're looking at this stuff every day, it's a different type of expertise, it's not fair to expect all IT workers to be cyber experts in an ever-changing world.
"Companies need to invest in training their staff in cybersecurity."
