A cyber-attack could spell disaster for your CPA firm

As aggregators of financial data, CPA firms are entrusted with their clients’ personal and financial information. As such, they’re primary targets for cybercrimes. Any size firm can fall victim. In fact, while more than half (55%) of all small businesses surveyed have already been the victim of a cyber-attack,¹ 8% of all cyber claims are related to professional services firms.²

The nature of cyber risks vary. First-party risks impact the accounting practice or firm directly, meaning the loss of data is directly correlated to lost business income. Third-party risks, on the other hand, arise from a breach of a CPA’s duty of care to others. Those risks are triggered by the unauthorized disclosure of a client’s sensitive/non-public personal information or by infection of a client’s network resulting in data corruption.

Other risks to CPAs as a result of cybercrimes include regulatory action by state and federal agencies, reputational damage and ancillary expenses related to complying with various breach response laws. To date, 48 states have data breach notice requirements, with the average cost of a breach response at over $200 per record.³ In addition, HIPAA requires notification after disclosure of unsecured personal health information, while the recently enacted New York State Data Security Regulations set forth a framework that financial institutions operating within the state must follow to maintain data security.

Successfully avoiding a cyber threat means first understanding the mindset and motivation of cybercriminals. Not all hackers are teenagers hanging out in their parents’ basements, simply looking for something to do. Many are disgruntled, unemployed “coders” or nation state-sponsored paramilitary groups lurking on the deep web hawking their skills, exchanging tradecraft and selling stolen data. Some are involved in traditional hacking methods, such as breaking into networks to steal and corrupt data. Still others manipulate users through phishing expeditions and social engineering to receive access into a system. Regardless of their motives — from mischievous, to malicious, to moneymaking schemes – cybercriminals can seriously threaten your firm’s continued success and profitability.

What can you do to thwart cybercriminals? The best defense to a data breach is to implement procedures to minimize the threat. Understand the nature of the data in your possession and establish methods for how to discover a breach. Having a robust internal reporting process and incident response plan is key. Two major points of vulnerability for CPA firms are the wide spread use of mobile devices, which can be vulnerable to malware when not patched properly, and easily lost exposing unencrypted data, and remote access to internal systems for the mobile workforce. To protect against these threats we recommend the following Best Practices in regard to cyber security:

Ensure full disk encryption on all laptops, desktops, mobile devices, and external storage
Utilize multi-factor (or at least two-factor) authentication for remote login

• Establish robust cloud/vendor management controls
• Conduct regular security awareness training for all employees
• Extend internal security controls to embedded devices like internet connected web cameras, HVAC, and door badge access systems
• Document and test incident response plans
• Establish a formal data retention policy – including secure deletion of data
• Ensure physical security of hardware
• Conduct annual penetration tests, and remediate identified issues

Since each state has its own breach notification laws, the timing to execute remedial measures is critical. Apply the law as the facts are discovered, and be cognizant of the applicable breach reporting deadlines. Under most breach statutes, one must comply with the rules even if no theft or damage occurred. When necessary, consider hiring vendors that have expertise in implementing a breach response plan that sets forth timely notification, forensic analysis of how the breach occurred, client credit monitoring and other regulatory compliance measures.

An inadequate breach response can be devastating to an accounting practice. Not only does it result in reputational harm, but can result in higher out-of-pocket expenses, including heavy fines, and more. Often times, the firm becomes a future “target” for other cybercriminals.

To further help insulate your firm from exposure, purchase appropriate cyber liability coverage. Remember that your existing coverage may not adequately cover a data security breach and the necessary response. Accordingly, consult with your insurance agent or broker when assessing your cyber coverage. Read the general terms and conditions of the policy and understand how it applies to first party risks (i.e., business interruption and data restoration) as well as to third party risks (i.e., network damage, privacy injury, event expenses, regulatory proceedings and extortion).

Cybercrimes are constantly evolving, which means CPAs need to stay abreast of the latest threats and take measures to impede them. In the meantime, firm employees should be fully trained in security awareness. Most of all, recognize that statistically, you have a greater chance of being hacked than not. Having adequate data security measures in place can make all the difference between being just another data victim or being a bulwark against data fraud.

1 2016 State of Cybersecurity in Small & Medium-Sized Businesses (SMB), Ponemon Institute LLC and Keeper Security.
2 NetDiligence 2015 Cyber Claims Study.
3 Ponemon Institute© Research Report, 2015 Cost of Data Breach Study: United States (based on 2015 reported breaches).