​Your business relies on emails every day – and that’s exactly why scammers target them.

Email has become an essential tool for any successful business, but as the saying goes, "with great power comes great responsibility".
 
As a business owner, it’s your responsibility to make sure your emails are secure. It’s one of the key ways to stop your business data falling into the wrong hands.
 
Business Email Compromise (or BEC) is a growing threat. And if you become a target, it could cost you – big time.
 

So, what exactly is a 'BEC attack'?
 
In simple terms, it’s where scammers pose as people high up in the business, like CEOs, executives, and IT staff. The goal is to trick your employees into sharing sensitive information or sending money. Research shows that nearly 90% of BEC attacks are set up this way.
 
It’s easy to see how someone might quickly respond without a second thought, especially when they trust the sender.
 

BEC attacks have spiked dramatically this year, especially over the third quarter. Researchers have analyzed 1.8 billion emails worldwide, discovering a shocking 208 million malicious emails among them. And of these malicious emails, more than half (58%) were BEC attempts.
 
The figures make it clear: BEC scams are now the biggest email threat to businesses.
 
​
Another thing worth noting? Most BEC scams target employees lower in the business, who might be less likely to question authority or be less aware of cyber threats.
 
Although BEC attacks are common, it’s also important to remember that scammers still use other methods too. This includes commercial spam and phishing attacks, which are designed to trick people into sharing personal information, like login details.
 
In fact, the combined effect of these types of scams now overshadows traditional ransomware and malware attacks.
 

Luckily, it isn’t complicated or expensive to protect your business. Simply make sure that all members of your team are trained to think twice about every email they receive.
 
If an email asks for sensitive information or a financial transaction – especially if it feels urgent – your employees should know to stop and check with someone before they action anything.
 
If you need help making sure your business is secure, get in touch.

What’s easy to overlook but could leave your business open to cyber attacks? Unused logins. Yep, something as simple as failing to delete an old account could have serious costs for your business…

When someone leaves your business, you might be so wrapped up in the rush of everyday tasks, you forget to delete their login details.
 
It’s easy to overlook. You’ll get around to it later, right?
 
But unused login details could be a ticking time bomb for security breaches, leaving the doors wide open to cyber criminals. It can also be an unnecessary drain on your budget if you’re paying for old subscriptions you no longer need.
 
A recent report found that almost half of businesses had accounts that were no longer actively managed.
 
If you’ve forgotten about an account, you’re not monitoring it. And this leaves your business vulnerable to attacks.
 
These risks aren’t just hypothetical, either. Many cloud security breaches happen because unused login details and accounts have been compromised.
 
So, what do you need to do?
 
Take the time to audit all accounts and login details used by your business. Make sure you no longer have accounts open for ex-employees (and check that their access has been fully revoked, not just left inactive). Even if you outsource your I.T., it's important to let your Managed Service Provider know when an employee has been terminated (I.T. folks may be magic, but we're not mind readers!).
 
The same goes for any software or service that you’ve stopped using in your business. You might not realize you’re still paying for a service you haven’t touched in months – or even years.
 
Going forward, make sure you have a clear process for when people leave, and regularly review the applications and services your business uses.
 
If you’re not sure where to start, let us help you perform a security review and make sure you’re not leaving your business exposed to unnecessary threats. Get in touch.

Microsoft is warning business owners that trusted cloud storage services are being hijacked to trick you into handing over your data.

Microsoft is warning business owners about a new type of phishing scam (where cyber criminals pose as a trusted source to trick you into giving away login info), which uses popular cloud services like SharePoint and OneDrive. Although these platforms are usually safe, scammers have figured out how to trick privacy settings to get past security checks.

The scammers hack your cloud storage by stealing your login details or buying them on the black market. Once they get inside, they upload a file that is designed to look authentic – like a fake Microsoft 365 login page. They set the file to “view-only” or limit access to specific people, such as you and your team.

Opening these files or following any links inside the emails could cause serious damage to your business. Scammers can use your information to access your systems, or they can install malware (malicious software) that lets them cause disruption and steal information.

Recovering from these kinds of attacks can be expensive and time-consuming – not to mention the damage it could do to your business’s reputation.

Make sure your employees are aware of this new threat and know to be cautious when opening emails, even if they appear to come from a trusted company or individual.

Before opening any shared files, double-check the sender’s identity. If something feels off, contact the sender directly to verify it. However, do not contact the sender by directly replying to the suspicious email. We strongly recommend calling the sender and speaking with them over the phone.

Make sure you use multi-factor authentication (MFA) across all your team’s devices. This adds an extra layer of security by requiring a second piece of information (like a code sent to your phone) along with your password. Also, keep your security software up to date so that it’s always ready to block the latest types of attack.

Would you like our help protecting your business with added security, training, and monitoring? Get in touch.

Your business data is backed up and recovery tools are in place. So, your data is safe, right? Sadly…not always. Here’s why we recommend backups are checked regularly.

​Losing access to your business’s data – even temporarily – is a nightmare worthy of a horror movie.

Data backup tools create copies of your data and store them in a safe place. If something goes wrong, recovery tools will use these copies to restore your lost files.

So, if your business already uses backup and recovery tools, you’d think your data is safe… but this isn’t necessarily true.

A new report shows that some backup tools aren’t always as reliable as they should be. In fact, a third of all data losses are caused by backup-related issues. When people try to recover data, they discover it’s been lost or corrupted.

It’s not just corrupted backups that you should be aware of. One of the biggest threats to businesses right now is ransomware. This is a type of malicious software (or "malware") that locks you out of your files unless you pay a ransom to regain access.

The report found that half of businesses using backup tools still ended up paying ransoms to retrieve their files, because it was faster than trying to use their own recovery tools. Even worse? Only a small number of businesses that paid ransoms were able to fully recover their data.

Backup tools are supposed to keep your data safe, so why are they unreliable for so many businesses?

Often, it’s because they haven’t been set up properly. And even when they are, they still need to be verified regularly to make sure they are still backing up your files. Also, older backup and recovery tools can’t always keep up with today’s sophisticated cyber attacks.

Setting up and maintaining a reliable backup system can be complicated. IT experts (like us) can make sure your tools are running correctly every day.

We can also put in place extra safeguards such as continuous data protection (CDP). This constantly saves changes to your files, allowing you to go back in time and restore your data as it was just before an attack or loss.

This is something we do for businesses like yours every day. If you’d like to discuss our Managed Backup Services, get in touch today!

Every time you send an email from your business, a lot of things happen automatically in the background to check that it’s a real email sent by you.

The email service providers such as Gmail, Yahoo, and Microsoft use algorithms to assess each individual email’s authenticity.
 
They’re trying to identify spam emails and phishing emails (these pretend to be from trusted sources but send people to fake websites where their login details are stolen).
 
To authenticate emails, there are three primary methods used:

1. SPF (Sender Policy Framework): Think of SPF like a list of friends you're allowed to send letters to. When you send a letter, the mailman looks at this list. If you're on it, your letter gets delivered. If not, the mailman thinks you might be pretending to be someone else, and your letter might not get to your friend.
   
   
2. DKIM (DomainKeys Identified Mail): DKIM is like a secret handshake or a special sticker you put on your letters. When your friend gets the letter, they check for the handshake or sticker. If it's there, they know the letter really came from you and wasn't changed by anyone else while it was being delivered.
   
   
3. DMARC (Domain-based Message Authentication, Reporting, and Conformance): DMARC is like a set of rules for the mailman, telling him what to do if a letter doesn't have the right sticker or isn't on the friends' list. It can tell the mailman to give it back, throw it away, or deliver it but tell your friend to check it carefully.
   

Big email companies like Gmail and Yahoo have insisted you need to have this new authentication requirements set up for your business… or they won’t deliver your emails.
 
We can check your email setup simply and quickly without needing any access to your systems. And if you do have an issue, we can advise you how to get it solved.  Reach out at 262-515-9499 and we can assess for you; you'll know by the end whether you have a problem or not.

If there’s one thing that’s 100% certain when it comes to protecting your business data, it’s that you need to be aware of phishing emails.
 
First things first, what exactly is a phishing email? Picture it as a wolf in sheep's clothing, posing as a legitimate communication to deceive unsuspecting recipients. These emails often contain malicious links, attachments, or requests for sensitive data, all disguised as a business or person you already know and trust.
 
And you know what they say: Knowledge is power. One of the best ways to stay safe is to stay informed. We can do that by looking at the most common phishing emails of last year.

There are three main categories of phishing themes: Major, moderate, and minor.
 
Major themes
 
The biggest category is finance-related phishing emails, making up a huge 54% of attacks. These emails often contain pretend invoices or payment requests, aiming to lure recipients into giving away financial information.
 
Following closely are notification phishing emails, making up 35% of attacks. These emails prey on urgency, claiming your password is about to expire or you must take some urgent action.
 
Moderate themes
 
Document and voicemail scams take center stage here, accounting for 38% and 25% of attacks respectively. These tactics involve deceptive files or messages designed to trick you into compromising your security.
 
Minor themes
 
While less common, minor phishing themes still pose a risk to people who don’t know what to look out for. These include emails related to benefits, taxes, job applications, and property.
 
 
Why should you be concerned about phishing emails? Falling victim to these scams can have serious consequences, including financial loss, data breaches, and damage to your company's reputation. It's essential to educate your employees about the dangers of phishing and put in place robust cyber security measures to protect your business.
 
Awareness and vigilance are your best defenses against phishing attacks. By staying informed, training your employees, and using strong security protocols, you can safeguard your company's valuable assets from cyber threats.
 
We help businesses like yours stay safe. If you’re not 100% sure you’re fully protected… let’s talk!

Businesses around the world are being struck with a cyber-attack that sends victims a fake invoice that looks real enough to fool to most employees. It’s an old scam that used to see bills faxed or mailed in, but it’s made its way into the digital world and instances are on the rise.

Chances are you’ve already seen some of the less effective attempts, like an email advising your domain is expiring, except it’s not from your host and your domain is nowhere near expiration. These new attacks are more advanced, in that they look completely legitimate and are often from contractors/suppliers you actually use. Logos are correct, spelling and grammar are spot on, and they might even refer to actual work or invoice numbers. The sender name may also be the normal contact you’d associate with that business, or even a co-worker, as cyber-criminals are able to effectively ‘spoof’ real accounts and real people. While it’s worrying that they know enough about your business to wear that disguise so well, a successful attack relies on you not knowing what to look for, or even that fakes are a possibility. With that in mind, here are two types of invoice attacks you might receive:

The Payment Redirect
This style of fake invoice either explicitly states payment should be made to a certain account, perhaps with a friendly note about the new details, or includes a payment link direct to the new account. Your accounts payable person believes they’re doing the right thing by resolving the invoice and unwittingly sends company money offshore. The problem usually isn’t discovered until the real invoice from the real supplier comes in or the transaction is flagged in an audit. Due to the nature of international cyber-crime, it’s unlikely you’ll be able to recover the funds even if you catch it quickly.

The Malware Click
Rather than go for the immediate cash grab, this style of attack asks your employee to click a link to download the invoice. The email may even look like the ones normally generated by popular accounting tools like Quickbooks or Xero, making the click seem safe. Once your employee has clicked the link, malware is downloaded that can trigger ransomware or data breaches. While an up-to-date anti-virus should block the attack at that stage, it’s not always guaranteed, especially with new and undiscovered malware. If it does get through, the malware quickly embeds itself deep into your systems, often silently lurking until detected or activated.

How to Stay Safe
Awareness is key to ensuring these types of attacks have no impact on your business. As always, keep your anti-virus and spam filters up to date to minimize the risk of the emails getting through in the first place. Then, consider implementing a simple set of procedures regarding payments. These could include verifying account changes with a phone call (to the number you have on record, not the one in the email), double checking invoices against work orders, appointing a single administrator to restrict access to accounts, or even two-factor authorization for payments. Simple pre-emptive checks like hovering the mouse over any links before clicking and quickly making sure it looks right can also help. Like your own business, your contractors and suppliers are extra careful with their invoicing, so if anything looks off - even in the slightest - hold back on payment/clicking until it’s been reviewed. Fake invoices attacks may be increasing, but that doesn’t mean your business will become a statistic, especially now that you know what’s going on and how you can stop them.

We can help increase your security, talk to us today. Call us at 262-515-9499.

15 years after the world united to crack down on spam emails, we’re still struggling with overloaded inboxes. All that unwanted email continues to flood the internet, much of it targeted towards small businesses, and the impact goes wider than you might think. Here’s the full breakdown of how modern spam works and how it’s hurting your business.

What is spam? Generally speaking, spam is any unwanted message that lands in your email, comes via text, social media messaging, or other communication platform. It might be sent to your main business account, eg your ‘contact us’ email, or direct to your employees. Most of the time, spam is annoying but relatively innocent messages from another business inviting you to buy/do/see something. They’re newsletters, reminders, invitations, sales pitches, etc. You may know the sender and have a previous relationship with them, or they might be a complete stranger. Occasionally, spam may even be part of a cyber attack.

Why you’re getting spammed. Maybe you or your employee signed up for a newsletter or bought a $1 raffle ticket to win a car. Perhaps you got onto the mailing list accidentally after enquiring about a product, not knowing that simply getting a brochure sent through would trigger a spam-avalanche. Often there’s fine print that says they’ll not only use your details to send you their marketing, but they’ll share your details with 3rd parties so they can send you messages too. That single email address can be passed around the internet like wildfire, and before you know it, you’re buried under spam. Sometimes, and more than we’d like to think, your details are found illicitly, perhaps through a hacked website for example, like the recent LinkedIn leak. More often though, your email is simply collected by a computer ‘scraping’ the internet - scouring forums and websites for plain text or linked emails and selling them as prime spam targets. It’s easy to see how individual office employees receive an average of 120 emails daily, over half of which are spam!

More than annoying. We all know spam is annoying, but did you know it’s also resource hungry? Your employees are spending hours each week sorting their email, assessing each one for relevance and deleting the spam. Too often, legitimate emails from clients and customers get caught up and are accidentally deleted. Add in the temptation to read the more interesting spam emails and productivity drops to zero. On the other side of the business, your email server might be dedicating storage and processing power to spam emails, occasionally to the point where inboxes get full and real mail is bouncing out. While most spam is simply an unwanted newsletter or sale notice, there’s also the risk that any links may be a cyber-attack in disguise. After all, one click is all it takes to open the door to viruses, ransomware, phishing or other security emergencies.

How to stop the spam. The 2003 Can Spam Act (a global set of anti-spam laws) requires all marketers to follow certain rules, like not adding people to mailing lists without permission, and always including an ‘unsubscribe’ link.  So firstly, make sure you’re not accidentally giving people permission to email you - check the fine print or privacy policy. Next, look for the unsubscribe link at the bottom of the email. Unfortunately, not all of them include the link, or they hide it somewhere impossible to see. The worst spammers take that ‘unsubscribe’ click to confirm that your email address is valid/active and then sell it on.

Talk to us about your anti-spam protections. Call us at 262-515-9499.

At last count, Facebook has clocked up over 2.7 billion users, which makes the platform more attractive than ever for scammers and hackers. While you may be logging in to share your latest family photos or catch up with friends, the chances of accidentally triggering a scam or malware are increasing daily. Here’s how to stay safe on Facebook and stop the spread.

Look out for freebies and surveys
Everybody loves a freebie and for the most part the competition posts on Facebook are legitimate. On the flip side though, when you see a giveaway for vouchers from a mega-store, alarm bells should ring. ‘Do this quick survey and we’ll send you a $50 Amazon Voucher!’ - it’s too good to be true. Even one click can take you on a messy journey through the underbelly of the web, picking up trackers and malware at every stop and at the end, you’re asked to share the post so your friends can get a voucher too...except nobody ever gets the reward.

Check your permissions with games and quizzes
Whenever you access a new game or quiz, you’ll need to give permissions for it to access your Facebook profile. Most people click the okay button without any thought, but if you review the permissions you’re giving, you’ll often find they’re asking for a massive amount of personal data; public profile, friend list, email address, birthday and newsfeed. Do they really need ALL this information? Sometimes the shakedown is from necessity, but sometimes the apps are preparing to launch attacks against you both on and off Facebook. For example, when you call your bank they ask certain questions like your full name, birthday and maybe which high school you went to. All that information is in your Facebook profile and now shared with your permission.

Don’t friend people you don’t know
Having lots of friends is always nice, but that friend accept could end up costing you. It might be someone pretending to know you, or a picture of a pretty girl to entice men (and vice versa). Once you friend them, they get access to everything your friends can see. In this case, it’s more than the risk of someone knowing your personal data, you’ve just given them intimate access to your life. It’s exactly how romance scams start, and there are even cases where the victim finds photos of their children circulating the internet.

If it’s weird, forget it
It doesn’t happen very often, but hackers find ways to take advantage of flaws in Facebook. A common hack that keeps popping up in various forms is to embed malware in a link. The virus then infects your machine and contacts all your friends with an enticing message, like asking whether a picture is of them. When they click to view the picture, the virus catches them and their friend list, and so on. Facebook is pretty good at staying on top of these flaws, but they need time to fix it. Just like if you got a weird email with an attachment from a friend, use that same level of scrutiny in your Facebook and don’t open messages or links that seem out of place.
 
Need help securing your privacy?  Talk to us.  Click here to Contact us.

The invention of Wi-Fi has been a science fiction dream come true. We can use our laptops anywhere in the house, our phones are using home internet instead of sucking down our cellular data, and our gadgets are all communicating. It’s essentially the backbone of the smart tech boom for home and business alike. Most networks are password-protected with an encryption called “WPA2” and this has been safe and secure, until now.

Recently, a security flaw called KRACK was discovered that allows hackers to break into Wi-Fi networks – even the secured ones. Your laptop, mobile phone, gaming console and even your smart fridge are possibly vulnerable as a result.

How KRACK works: The Key Reinstallation AttaCK isn’t a problem with your device or how it was set up. It’s a problem with the Wi-Fi technology itself. The attack gets between your device and the access point (eg router) to reset the encryption key so hackers can view all network traffic in plain text. Since we rely on Wi-Fi so much, this might mean hackers have a front row seat to your credit card numbers, passwords, chat messages, emails, photos and more.

NOTE: The hacker must be in physical range of your Wi-fi to exploit this flaw, it doesn’t work remotely like other attacks we’ve seen recently. Given most Wi-Fi ranges extend well past your own home/business, this is small comfort, but important to know.

How to protect yourself

Run your updates: Software updates are being released which fix the flaw. Microsoft has already released one for Windows, Apple has one coming in a few weeks. Take a few minutes to make sure you’re up to date with all your patches on any device that uses Wi-Fi (your smartphones, laptops, tablets, PCs, game consoles, etc). Unfortunately, some devices may be slow to get an update, or if they’re older, may not get an update to fix this issue at all. If possible, consider using a cabled connection on those older devices or upgrade to one with support.

Be very careful with public Wi-Fi: While your local business center, library or school campus has expert IT professionals keeping guard over your security, it’s a very different matter at your local coffee shop. It’s unlikely small locations such as this will be on top of security patches. Remember, a hacker exploiting this flaw only needs to be in the same Wi-Fi area as you, so be careful you don’t give them a dollop of private information with their coffee.

Check your browser security: Before sending anything secure over the internet, check you’re using a HTTPS site. You’ll know these by the little padlock you see next to the URL, and the address specifically begins with HTTPS. Major sites like Facebook, Gmail and financial institutions already use HTTPS. 

If you need help updating your devices, or want us to check if you’re safe, contact us.