Cyberattacks are now so common that the majority of businesses responding to a new survey not only viewed them as their top concern but a majority saw a future attack on their organization as inevitable.

An annual survey of businesses by insurance giant Travelers Cos., which underwrites cybersecurity coverage, ranked cyberattacks as the top concern in an overall environment that was becoming more risky for doing business.

“Cyberattacks can shut down a company for a long period of time or even put it out of business, and it’s imperative that companies have a plan in place to mitigate any associated operational or financial disruptions,” Tim Francis, enterprise cyber lead at Travelers, said, in a release.

Arthur House, former chief cybersecurity risk officer for Connecticut, said Monday the survey shows what many businesses are still reluctant to talk about publicly.

“There is still somewhat of a stigma to admitting that you have been hacked in a cyberattack, said House, now an adjunct professor at the University of Connecticut teaching about cybersecurity. “As though you didn’t protect yourself adequately or there was something wrong with your IT systems.”

But House said the survey points to the reality that no company is safe from a cyberattack.

“It’s like an illness, everybody gets it,” House said. “There is not something necessarily wrong with you.”

The key, House said, is taking preventative measures as much as possible.

Those responding to the Travelers survey also saw bigger concerns compared with a year ago about economic uncertainty, rising energy costs and the ability to attract and retain employees.

The survey of 1,200 small, medium and large companies across 15-plus industries sampled opinion in mid to late July and was conducted by Hart Research for Travelers.

Travelers began its survey in 2014, and it is used as the basis for the Travelers Risk Index. For the third time in the past four years, cybersecurity ranked as the top overall concern among businesses.

But unlike a year ago, when cyberattacks ranked 6 percentage points above the next biggest concern, other issues ranked closer this year to cybersecurity.

In 2022, 59% of those responding to the survey said they “worried some or a great deal about cyberthreats.” But that was followed closely with 57% concerned about broad economic uncertainty; 56% worried about fluctuations in oil and energy costs; 56% concerned about the ability to attract and retain worker talent; and 56% worried about inflation in medical costs.

Among the biggest jumps compared with a year ago was the cost of energy, up 16 percentage points, from 40% a year ago. Supply chain disruptions increased 11 percentage points to 54%.

A report earlier this month by insurer Hiscox found that cyber criminals, who have long targeted large companies are moving down to small and mid-size employers.

In its report, Hiscox found that companies with annual revenues of $100,000 to $500,000 can now expect as many cyberattacks as those earning $1 million to $9 million. Yet, spending on cybersecurity has fallen with smaller firms.

Gareth Wharton, Hiscox’s cyber chief executive, said the pandemic may have played a part in the trend.

“The move to remote working has prompted many smaller businesses to adopt cloud solutions in preference to building out their own remote services,” Wharton wrote in an introduction to the report. “That, in turn, has encouraged more cyber criminals to exploit vulnerabilities in cloud applications and target cloud service providers, too.”

Ransomware attacks increased, with 19% of those responding to the Hiscox survey reporting one in the past year, up from 16% a year earlier. Two-thirds of the firms paid their attackers, Hiscox found.

The Travelers survey found that 71% of the companies responding to the survey had been the target of a data breach of other “cyber event” more than once.

“Multiple cyber attacks may not be random—if you are vulnerable before and don’t take appropriate action as a result, you continue to be a risk,” Travelers’ Francis said.

Distributed by Tribune Content Agency, LLC.

A sprawling disinformation network originating in Russia sought to use hundreds of fake social media accounts and dozens of sham news websites to spread Kremlin talking points about the invasion of Ukraine, Meta revealed Tuesday.

The company, which owns Facebook and Instagram, said it identified and disabled the operation before it was able to gain a large audience. Nonetheless, Facebook said it was the largest and most complex Russian propaganda effort that it has found since the invasion began.

The operation involved more than 60 websites created to mimic legitimate news sites including The Guardian newspaper in the United Kingdom and Germany’s Der Spiegel. Instead of the actual news reported by those outlets, however, the fake sites contained links to Russian propaganda and disinformation about Ukraine. More than 1,600 fake Facebook accounts were used to spread the propaganda to audiences in Germany, Italy, France, the U.K. and Ukraine.

The findings highlighted both the promise of social media companies to police their sites and the peril that disinformation continues to pose.

“Video: False Staging in Bucha Revealed!” claimed one of the fake news stories, which blamed Ukraine for the slaughter of hundreds of Ukrainians in a town occupied by the Russians.

The fake social media accounts were then used to spread links to the fake news stories and other pro-Russian posts and videos on Facebook and Instagram, as well as platforms including Telegram and Twitter. The network was active throughout the summer.

“On a few occasions, the operation’s content was amplified by the official Facebook pages of Russian embassies in Europe and Asia,” said David Agranovich, Meta’s director of threat disruption. “I think this is probably the largest and most complex Russian-origin operation that we’ve disrupted since the beginning of the war in Ukraine earlier this year.”

The network’s activities were first noticed by investigative reporters in Germany. When Meta began its investigation it found that many of the fake accounts had already been removed by Facebook’s automated systems. Thousands of people were following the network’s Facebook pages when they were deactivated earlier this year.

Researchers said they couldn’t directly attribute the network to the Russian government. But Agranovich noted the role played by Russian diplomats and said the operation relied on some sophisticated tactics, including the use of multiple languages and carefully constructed imposter websites.

Since the war began in February, the Kremlin has used online disinformation and conspiracy theories in an effort to weaken international support for Ukraine. Groups linked to the Russian government have accused Ukraine of staging attacks, blamed the war on baseless allegations of U.S. bioweapon development and portrayed Ukrainian refugees as criminals and rapists.

Social media platforms and European governments have tried to stifle the Kremlin’s propaganda and disinformation, only to see Russia shift tactics.

A message sent to the Russian Embassy in Washington, D.C., asking for a response to Meta’s recent actions was not immediately returned.

Researchers at Meta Platforms Inc., which is based in Menlo Park, California, also exposed a much smaller network that originated in China and attempted to spread divisive political content in the U.S.

The operation reached only a tiny U.S. audience, with some posts receiving just a single engagement. The posts also made some amateurish moves that showed they weren’t American, including some clumsy English language mistakes and a habit of posting during Chinese working hours.

Despite its ineffectiveness, the network is notable because it’s the first identified by Meta that targeted Americans with political messages ahead of this year’s midterm elections. The Chinese posts didn’t support one party or the other but seemed intent on stirring up polarization.

“While it failed, it’s important because it’s a new direction” for Chinese disinformation operations, said Ben Nimmo, who directs global threat intelligence for Meta.

A University of Queensland study has identified a need to prioritize cybersecurity training for board directors, to better protect Australian organizations from cyber-attacks.

Dr. Ivano Bongiovanni from the UQ Business School said his research found board directors were not always sure about their duties and liability for cybersecurity, and often did not fully understand its importance.

“As the data breach at Optus this month demonstrates, no organization is immune to cyber-crime,” Dr. Bongiovanni said.

“We interviewed non-executive directors of 43 organizations about cybersecurity; a lot of uncertainty emerged in terms of current best practices or industry guidelines for cybersecurity strategies.

“There is a misleading perception of cybersecurity being a purely technical topic and directors weren’t engaged or confident talking about it.

“Considering the responsibility to oversee cyber risk management in modern organizations lies with their board of directors, an uplift of cyber-skills at the board level is necessary.”

Cybersecurity failure is considered one of the top threats facing Australian businesses, and with customer information accessed in an attack on Optus, the Australian Cyber Security Centre is warning companies to remain alert.

Study co-author and UQ honors graduate Megan Gale said the potential impact of data breaches on Australian organizations was massive.

“A disruption to IT infrastructure could force a company to shut down, leading to financial loss or even more severe consequences,” Ms. Gale said.

“In the Optus breach, sensitive, personal customer information along with identity documents have been accessed, putting people at risk of being victims of fraud.”

The researchers have called for clearer regulations and reporting practices and for cybersecurity training to be made a priority for all board directors.

“It’s not just boards of large companies that need to be better equipped in this area,” Ms. Gale said.

“Boards of small to medium-sized organizations across all sectors in Australia, including not-for-profits and community-run organizations, need to be vigilant.”

Director of Cybersecurity at UQ and the Australian cyber emergency response team AusCERT, Dr. David Stockdale, said the study showed Australia has some work to do for boards to include cybersecurity in their enterprise risk management activities.

“As we’ve seen with Optus, cyber threats are a matter of ‘not if, but when,’ and organizations must be prepared,” Dr. Stockdale said.

“More cyber risk training and regular communication between executives and their security teams will ensure the best course of action and prevention.”

The study also involved Associate Professor Sergeja Slapnicar from the UQ Business School. Their research has been published in Computers & Security.