Email threats against global businesses grew 64% in 2020 due to remote working

Employees click on three times as many malicious emails since outbreak of pandemic

The average annualised cost of cyber crime for financial organisations worldwide increased to $18.5 million, according to a 2019 report by Accenture. EPA

Email threats against global businesses surged by more than 64 per cent on an annualised basis last year, spurred by a rapid shift to remote working amid the Covid-19 pandemic, a survey suggests.

London cyber-security company Mimecast released its State of Email Security report on Tuesday.

It said hackers were quick to take advantage of users' weak security systems and employees’ vulnerability to clicking on malicious links embedded in the emails.

Mimecast did not disclose the exact number of email attacks against businesses last year.

“These exposure points are inflamed by so many companies rapidly adopting digital office models,” said Josh Douglas, vice president of threat intelligence at Mimecast.

"Leaving employees untrained and unprotected in this highly distributed digital environment puts organisations at risk of digital deception."

The coronavirus pandemic led to a huge shift in workplace patterns last year, with offices switching to remote working to stem the spread of the pandemic.

Some workers have returned to their offices but infection surges have kept others around the world shut or at half capacity.

Employees are also clicking on three times as many malicious emails as they had before the pandemic, the report showed.

Mimecast commissioned research company Vanson Bourne to conduct a global survey of 1,225 information technology and cyber-security professionals.

They came from the US, the UK, Germany, the Netherlands, Australia, South Africa, the UAE, Canada, Sweden and Denmark.

Participants from the companies – which ranged from 250 to 500 employees – were interviewed in February and March.

The report does not disclose the number of respondents surveyed in each country.

The report also showed that the number of ransomware attacks rose globally because of working from home.

Ransomware is malware that encrypts a victim's files. The attacker then demands a ransom to restore the user's access.

Globally, almost 61 per cent of the surveyed companies were affected by a ransomware attack last year.

About half (52 per cent) of them paid the ransom but of those, only two thirds recovered their data.

Companies that experienced an attack lost an average of six working days, the report said.

In the UAE, 78 per cent of the companies polled said they were affected by a ransomware attack last year.

Nearly 43 per cent of victims in the UAE also admitted paying the ransom, but only 44 per cent of those were able to recover their data.

“Many companies are choosing to pay ransoms rather than risking extensive business downtime and expensive consulting fees to conduct self-remediation," Mr Douglas said.

"But this introduces its own set of risks, including threat actors not holding up their end of the bargain."

Paying ransom also makes companies “an attractive target for subsequent attacks, since they have demonstrated they are willing to pay”, he said.

Almost 71 per cent of the businesses surveyed globally are also worried about the safety of their archived business record of conversations, in tools such as Slack or Teams.

Nearly 70 per cent of global respondents believe that employee failings such as weak passwords are putting their companies at risk.

Only 50 per cent of the companies surveyed in the UAE consider employees’ naivety to be one of their biggest vulnerabilities.