Identity theft is one aspect of our connected world that does not seem to be going away. Cyber criminals are constantly becoming savvier at stealing your personal information and identity.
Even COVID-19 hasn’t stopped them. In fact, it has only provided more opportunities to prey on the vulnerable. In this article, we’ll talk about what hackers are doing to take advantage of unsuspecting victims, discuss identity theft recovery strategies, and also detail a recent presentation on cyber crime.
Hacking in the Time of COVID
You probably have plenty to worry about this year. Unfortunately, you’ll have to add the threat of identity theft to your list. Criminals are using the coronavirus as a ruse to obtain people’s personal information.
Recently, as Norton Internet Security reports, cyber criminals have sent phishing emails intended to look like they’re from the CDC. The emails claim you’ve been exposed to COVID-19, which may mislead you into clicking a link to find out more. But clicking that link could introduce your computer to malware or lead you to divulge sensitive personal information to criminals.
Along the same line, cyber criminals have started sending emails that offer health advice. These messages include offers of medical advice that claim to help protect you against COVID-19.
Some emails are designed to blend in with your normal work email. They are messages that target workplace email accounts and make claims about updates to corporate policy, offering a link or attachment to click or download.
You should always be suspicious of online requests for personal information. No one from a trusted organization is going to ask you for very sensitive personally identifiable information (PII) over email. These things include:
- Social security numbers
- Drivers license numbers
- Medical history
- User names or passwords for any online system
- Credit card information
- Bank account information
Cyber criminals using COVID-19 as a cover will be looking for access to these things. If you are ever in doubt, give the organization a call at a number you independently verify from their website.
If you receive an email with a link, remember to check the email address or link by hovering over it. This lets you see where it is trying to lead you. Sometimes that is not obvious.
But remember that some links can closely resemble the real thing. If a link looks suspicious, reach out to the organization independently to confirm its authenticity.
Watch out for poor grammar, spelling errors, and generic greetings, and avoid emails that request information or immediate action.
Identity Theft Coverage for Employees
If your district purchases Crime coverage from us, then Identity Recovery coverage is included for board members and all non-temporary employees.
This coverage includes access to a hotline so employees can speak with counselors to assist with the process of restoring their credit. The coverage reimburses expenses up to $35,000 and includes credit bureau reports, fees for reapplying for declined loans, postage fees, child/elder care, and mental health counseling.
Note that this coverage will not reimburse funds stolen or fraudulently charged, since these funds are normally recoverable from an employee’s bank, credit union, or credit card company.
Coverage for Districts
Districts that handle PII for customers, employees, or patients must also be careful with that sensitive information. Colorado has a wider than average definition for what constitutes PII. The state also has strict rules about notifying victims of data breaches, so it’s important to know the rules here. The state’s definition includes:
- Social security, passport, and military ID numbers
- Email addresses, passwords, passcodes, and security question answers
- Any ID number from a government-issued credential (school ID, driver’s license, etc.)
- Employee ID numbers
- Biometric data
- Bank account numbers and PINs
If you are housing this information, you have a duty to protect these assets. It is important to have contingency plans in place in the event of a breach.
The Pool provides a $200,000 Cyber limit, which includes coverage for first-party expenses and third-party liability, but in many cases this wouldn’t be enough.
Therefore, we are offering $1,000,000 limits at no cost to members that complete a cyber assessment through our partners at NetDiligence. The Pool pays for a few of these every year on a first-come, first-serve basis. After that, members are eligible to receive special pricing on the cyber assessments and can reimburse up to 50% of the cost through the Safety Grant program.
Additional Resources
eRiskHub is a web portal with a broad toolbox of resources including a comprehensive incident road map to help you navigate a breach event. This program is free for all members.
Also, the Pool and SDA recently invited back former FBI agent and current cyber crime expert Michael Bazzell to expand upon his presentation from last year’s Conference. These recordings are available to view on demand for anyone that is a member of the SDA. You will just need to sign in to your SDA account and visit sdaco.org/pool-trainings.
There are three presentations. Two focus on public sector organizations. In these first two presentations, Bazzell outlines the way cyber criminals will attack, what tools they use, and what the repercussions are.
These presentations also cover training and guidance on the current state of computer crimes. Bazzell also discuses the reason why government agencies are seeing cyber crime as much or even more than other organizations.
Bazzell specifically calls out ransomware. This takes the form of a virus or malicious software that gets on your machine and locks you out of your system. The hacker asks for payment in order to release the system or data being held hostage.
Not surprisingly, hackers are developing new styles of attack. However, they are not as obvious as they used to be. Hacks happen in the background, and today’s attackers aren’t just encrypting your data. They’re making a copy and using it against you by threatening to share it with the world.
Bazzell covers a lot of ground on these topics, specifically ransomware. It’s a good idea for anyone at your district to check out the videos, but we think its really important for management and anyone involved with information security or technology.
Benefits of Planning
These cautionary tales are not without a point. Over and over, Bazzell drives home the same simple solutions: training, awareness, and preparation.
One of the best protections against paying ransom is to have your information backed up, separate from your main systems, and easily accessible. Checks and balances are also critical, especially if you use an IT firm to handle your needs. Without routine audits, your data may not be as secure as you think it is.
Promoting education and awareness and having a plan in place can make all the difference. Make this a part of your culture, and talk about it at meetings as well as annually at a board meeting. A few important questions to consider:
- What kind of information are we storing, and what are the dangers posed if it were to be stolen?
- What are we doing about number one?
- What do we need to better protect the district?
- When did we last test our back-up plan?
For more information about the tools that the CSD Pool has to offer you, such as eRisk Hub, cyber assessments, or coverage limits, email us at info@csdpool.org.
