On March 25, the Small Business Administration (SBA) discovered a programming error on its website that exposed the personal information, including social security numbers and addresses, of businesses applying for Economic Injury Disaster Loans (EIDL) to other EIDL applicants. The agency said it has corrected the website and notified the businesses that were impacted. As well, the agency said it will provide a year of credit monitoring to the affected organizations.

Cyber-criminals and hackers are likely to try to take advantage of the SBA EIDL website error. It is their habit to use such situations to wreak havoc on businesses and individuals through social engineering attacks such as phishing. Recently, the U.S. Department of Homeland Security (DHS), the Cybersecurity and Infrastructure Security Agency (CISA) and the U.K.’s National Cybersecurity Security Centre (NCSC) issued a joint alert regarding the growing use of COVID-19 related themes by malicious actors.

A few suggestions to help you protect your identity:

1. Scrutinize emails pertaining to COVID-19, the CARES Act, EIDL and PPP:

• Would the entity that the email is “supposedly from” typically request personal information or account information via email?
• Use “hover over” technique on the hyperlink contained in the email.
• Carefully examine the resulting URL for the website/entity that will process the request.
• Verify the request via a different method (i.e., phone or online chat instead of email).

2. Consider freezing your credit files:

• A provision of the Economic Growth, Regulatory Relief and Consumer Protection Act eliminates the fees associated with freezing and un-freezing your credit files.
• Consider how often your information is public and vulnerable and what purchases might impact your credit or warrant a credit check.
• Learn more about freezing your credit files at the Annual Credit Report website. Follow these prompts:
• Choose the “Protect Your Identity” tab.
• Then choose “Security freeze basics” on the left-hand side of the screen.

3. Review your annual free credit report via the Annual Credit Report website:

• It is authorized by federal law.
• You are entitled to one free report from each of the following credit bureaus every year.
• Equifax
• Experian
• TransUnion

4. If your bank offers it, enable Multi-Factor Authentication (MFA) for all your online financial accounts.

While these are easy steps to take to provide some protection, our list is hardly all-inclusive. As well, there is no comprehensive list of COVID-19-related malicious cyber activity. Individuals and organizations should remain alert to increased activity relating to COVID-19 and take proactive steps to protect themselves.

The HBK Risk Advisory group can answer your questions about identity theft and other cyber security matters. For more information, contact me at WHeaven@hbkcpa.com.

The new year brings with it an opportunity for a fresh start. From a cybersecurity perspective, a new year is also a typically dangerous time. Cyber hackers and cyber criminals often take advantage of the opening of tax season—January 7 for businesses, January 27 for individuals—to unleash social engineering campaigns. The campaigns can be digital, or phone based. They’re looking to steal login credentials or PII and will stress the need for you to respond urgently to an important communication, typically from your financial institution or accounting firm, about a problem with your account, a law you may have violated, or something else that requires your immediate attention.

As if such risks are not enough to wrestle with, the dawn of 2020 brings with it additional cyber worries rooted in the recently increased tensions between the U.S. and Iran. The Iranian government suggested its response to the killing of General Qasem Soleimani “concluded” with its January 7 missile launch. But according to The New York Times, cybersecurity experts are picking up on ongoing malicious cyber activity from pro-Iranian forces. And while Iranian cyber capabilities are not on par with those of Russia, China or the U.S., Iran does have the capability to inflict damage via a cyber attack.

The Cybersecurity and Infrastructure Security Agency (CISA), which was created through the Cybersecurity and Infrastructure Security Agency Act of 2018, is charged with protecting the nation’s critical infrastructure from physical and cyber threats. The agency’s January 6 Alert AA20-006A “Potential for Iranian Cyber Response to U.S. Military Strike in Baghdad” suggests that employees as well as the IT departments of organizations adopt a heightened sense of awareness and increase organizational vigilance.

What you should do:
*Use known contact methods instead of those provided in an email or voicemail
*Do not open attachments or click links unless you are certain they are from a verified “trusted source”
*Do not divulge sensitive information unless you have verified the recipient
*Be sure to use approved solutions for transmitting sensitive information with clients or third parties

Cyber criminals continue to ramp up efforts to disrupt organizations and their ability to function in a digital society. Organizations must continue to enhance their efforts to keep themselves from becoming victims of cyber crimes.

Attend Our Cybersecurity Webinar
On Wednesday, January 22 join HBK Risk Advisory Services Director Matt Schiavone for our first webinar of 2020, “Security Awareness Programs: What You MUST Know to Protect Your Company & Workforce” at Noon EST. Register for the free webinar here.