The risks caused by the coronavirus are rising beyond public health, job losses and economic spirals. Cyberthreats, including phishing scams and spam, are spiking as online criminals take advantage of the coronavirus to attack remote workforces and corporate systems, and tech vendors, such as SaaS providers, are less able to respond in the current situation.
More than one-third (36%) of executives on the CNBC Technology Executive Council say that cyberthreats have increased as a majority of their employees work from home, according to a CNBC flash survey conducted this week that included responses from 33 out of 157Â members of the Council, who serve in senior technology positions at large companies, as well as at government and nonprofit organizations.
One respondent said their organization has seen phishing and other cyber scams rise 40%. Some experts say the level of cyber risks is likely even higher than the survey indicates.
"We are hearing from many clients and law enforcement that the level of cyberattacks, phishing attempts and scams occurring in light of COVID-19 has grown dramatically," said Miriam Wugmeister, partner and co-chair of law firm Morrison & Foerster's global privacy and data security group. "The bad guys know that every IT department and every cybersecurity group is currently overwhelmed and stretched."
Hackers are using the emotional toll of the global public health crisis to their advantage as well.Â
"We've definitely seen an uptick in COVID-19 phishing attempts that are making emotional appeals and using the crisis to drive urgency," said Tom Hale, SurveyMonkey president.
Beyond the corporate sector, cyber concerns are running high as recent targets of hacking attempts, such as local government networks, send workers home. That's the case in Cary, North Carolina, a burgeoning tech hub that is home to companies like Fortnite maker Epic Games.
"In a matter of days, we've had to prepare hundreds of staff to work remotely. Because we're a government organization, we have staff in a variety of roles, and for many of them, working from home hasn't been part of their lives before this week," said Nicole Coughlin Raimundo, chief information officer for the Town of Cary.
Cary has deployed security measures like antivirus, endpoint and remote support solutions, but employees' home networks may not be as secure as the town network. "We have seen an increase in phishing campaigns recently," Raimundo said.
But she cautioned against a definitive link between the cybercrime spike and the coronavirus. "We haven't attributed them to a specific source, and we can't say for sure that it's related to the COVID pandemic. As part of our work-from-home guidance, we're continuing to encourage staff to be vigilant and exercise extreme caution when clicking outbound links, reminding them of the ransomware attacks that have hit so many of our neighboring communities."
More employees will be heading home for work
Near-85% of the senior technology executives surveyed by CNBC said at least half of their workforces are working from home; 25% of organizations are now entirely remote, and more are nearing that goal.
Nationwide's chief technology officer Jim Fowler said the insurer introduced a 50% work-from-home staggered schedule for its associates last week as a way to transition to social distancing and ensure operational readiness for a broader work-from-home approach. Nationwide is moving to a complete company-wide work-from-home schedule with full implementation by next Monday, or earlier if local regulations require it.
Fowler said Nationwide has not seen a significant uptick in targeted phishing scams and spam, but he expects it is only a matter of time.
"What we are counseling our associates about are bad actors setting up malicious websites, posing as reputable sources of information about coronavirus," he said. Fowler added, "I do anticipate that we will see an uptick in targeted attacks across the country. Businesses should anticipate that bad actors will assume that people aren't manning the gates, providing them with an opening."
Nationwide is warning employees to be aware of the wide variety of devices connected to home networks, which could include smart thermostats, gaming consoles, baby monitors, TVs, appliances and possibly even cars. The best defense is to make sure they are protected with a strong password and have had all system updates applied.
A little over half of respondents (53%) to the CNBC survey say their firms never stress-tested their systems for an event like this. But that's not a surprise, according to experts. "I don't think anticipating that the vast majority of employees across the U.S. and Europe would all have to work remotely was a common anticipated risk," said Wugmeister of Morrison & Foerster. "It is not surprising that most companies did not stress-test what we are living through now."
"Most companies prepare for peak traffic, security breaches and business continuity for natural disasters," Hale said. "All of those have a degree of certainty that allows for preparation, but this crisis is more of a shift in behaviors with a tremendous amount of uncertainty. With more children being at home on video games and using streaming services, this will also place stress on home Wi-Fi networks."Â
More from Technology Executive Council:
What can happen to a company if coronavirus sends every employee home
The hacker behind your company's data breach may be sitting right in the next cubicle
Hackers' delight: Small businesses investing more in Internet of Things, less on cybersecurity
