Cybersecurity

As a business leader, you’re always looking for ways to increase revenue, cut expenses and grow your bottom line. Implementing AI tools, shopping services and running a more efficient operation are great ways to do that. One place you do NOT want to cut corners is using free antivirus or firewall software. In today’s blog, we’ll share why these seemingly helpful software solutions are a detriment to your business and why a 10-minute call with our team might just be the best investment you’ll make this year. Free software often lacks necessary features and is limited in what it can detect. Free antivirus software and firewall solutions can protect your business against some known viruses but not all of them, and they likely won’t have the ability to protect you against other comprehensive threats, like malicious files, unknown or unidentified threats and more. Cybercriminals are constantly rolling out new and “improved” viruses to trick even the most robust security solutions, which makes it difficult to believe that free, infrequently updated antivirus solutions could offer the level of protection needed to keep you secure. There’s no such thing as a free lunch. While free cybersecurity solutions sound like a good way to save a few bucks, you have to stop and realize these programs will make their money somewhere. The most common ways they make money are through ads, sponsored recommendations and collecting and selling user data. They collect and sell your personal information, like age and gender, and installed apps, to third-party advertisers. Some free solutions are already infected with malware. Ironically, these free cybersecurity tools can come with malware already installed to infect your computer upon downloading them. It’s also difficult to determine the difference between real free software solutions and fake ones created by hackers looking to trick unsuspecting business owners who hope to save a buck into downloading an infected version that immediately opens up your network to them. Free antivirus software is mostly reactive, detecting infections after they’ve happened. The point of having cybersecurity solutions is to try to prevent a data breach from occurring in the first place. Most free solutions are reactive and won’t keep unwanted intruders out; they simply alert you when one has already breached your network. If you’re going with a free solution, make sure you have a robust recovery plan in place. You’ll likely need it. Cybersecurity solutions are not as expensive as most business owners think and are more cost-effective than dealing with a data breach. If you have been using free antivirus or firewall software in your organization, it’s time to level up. Our cybersecurity experts will provide you with a FREE Security Risk Assessment that will detail if and where you’re vulnerable and what to do about it. Schedule yours by clicking here or calling us at 774-241-8600.

In recent months, the alarming cybersecurity breach at Change Healthcare, the health care payment-processing company under the health care giant UnitedHealth Group, has thrown a spotlight on a chilling reality: cyberthreats can lurk undetected within our networks, ready to unleash chaos at a moment’s notice. The breach, executed by the notorious ALPHV/BlackCat hacker group, involved the group lying dormant within the company’s environment for nine days before activating a crippling ransomware attack. This incident, which severely impacted the US health care system, a network with a large budget for cybersecurity, underscores an urgent message for all business leaders: a robust cybersecurity system and recovery plan are not optional but a fundamental necessity for every business out there. The attack began with hackers using leaked credentials to access a key application that was shockingly left without the safeguard of multifactor authentication. Once inside, the hackers stole data, locked it down, and then demanded a hefty ransom. This action stalled nationwide health care payment-processing systems, for thousands of pharmacies and hospitals causing them to grind to a halt! Then things got even worse! The personal health information and personal information of potentially millions of Americans was also stolen. The hackers set up an exit scam, demanding a second ransom to not release this information. This breach required a temporary shutdown, disconnecting entire systems from the Internet, a massive overhaul of the IT infrastructure and significant financial losses estimated to potentially reach $1.6 billion by year’s end. Replacing laptops, rotating credentials and rebuilding the data center network were only a few of the actions the UnitedHealth Group had to take. More than financial, the cost was deeply human – impacting health care services and risking personal data. While devastating, it’s a powerful reminder that threats can dwell in silence within our networks, waiting for an opportune moment to strike. It is not enough to react; proactive measures are essential. Ensuring systems are secured, implementing multifactor authentication, regularly updating and patching software and having a recovery plan in place in the event of an attack are steps that can no longer be overlooked and are basic requirements for doing business in today’s world. Also, the idea that “We’re too small to be a target” is false. Just because you’re not big enough to make national news, doesn’t mean you’re too small to be attacked! Cybersecurity isn’t just an IT issue; it’s a cornerstone of modern business strategy. It requires investment, training and a culture of security awareness throughout the organization. The fallout from a breach reaches far beyond the immediately affected systems. It can erode customer trust, disrupt services and lead to severe financial and reputational damage, and your business, will be the one blamed. As we consider the lessons from the Change Healthcare incident, it’s your duty to make cybersecurity a top priority. Investing in comprehensive cybersecurity measures isn’t just a precaution – it’s a fundamental responsibility to our customers, our stakeholders and our future. Remember, in the realm of cyberthreats, what you can’t see can hurt you – and preparation is your most powerful defense. Is YOUR organization secure? If you’re not sure, or just want a second opinion, our cybersecurity experts will provide you with a FREE Security Risk Assessment that will detail if and where you’re vulnerable and what to do about it. Schedule yours by clicking here or calling us at 774-241-8600.

In a statement released by the largest telecommunications company in the United States, AT&T, they shared that they recently discovered a dataset for sale on the “dark web” that contained information for about 7.6 million current AT&T account holders and 65.4 million former users, totaling approximately 73 million affected accounts. AT&T shared that the data released contained passcodes (PIN numbers) and Social Security numbers from 2019 or earlier and did not contain any other personal financial information or call history but could possibly include e-mail and mailing addresses, phone numbers and birthdates. AT&T has reached out to all customers via e-mail or mail to let them know of the breach and to reset their passcodes. If you’re an AT&T customer, it’s important to be highly critical of any e-mail asking you to change your password. Please make sure it is from AT&T, as it’s suspected other cybercriminals will attempt to capitalize on this issue and send out fake e-mails with malicious links, hoping someone will click on them. If you’re concerned it’s a fake e-mail, call AT&T support and ask them to send another reset link while you’re on the phone. As for the cause of the breach, it’s still unknown whether the data breach originated from AT&T or one of its vendors, but AT&T has launched an investigation and will likely hire computer forensics specialists to find the cause of the incident. The organization will also have to scrub any installed malware out of the software that runs its customer account system without disrupting unaffected customers’ service. Between the investigation, cleaning up the issues, lawsuits, legal fees and more, this will be an expensive issue to solve. That’s why at [Company Name], we talk about being proactive with cybersecurity so often. While no solution is 100% impenetrable, most are strong enough to keep the majority of hackers out. It is way more costly to deal with the effects of a cyber-attack than it is to prevent one in the first place. If you’re concerned about the safety of your organization, request a FREE Security Assessment from our team of cybersecurity experts. We’ll analyze your network so you can see if there are exposed entry points in your network that hackers could use to break in. We’ll also advise on how to work with third-party vendors to ensure your and your customers’ data is as secure as possible. Hackers will do whatever it takes to break into your network. Your job as the CEO is to do whatever it takes to keep them out. We are here to help! Click here to book your Security Risk Assessment with one of our cybersecurity experts, or call our office at 774-241-8600.

Another day, another cyber-attack! In early April, Omni Hotels & Resorts was the victim of a cyber-attack that brought down the entire IT system and led to a company-wide outage. The organization took immediate action and brought the entire network offline to isolate the issue, protect its data and prevent further damage from occurring. Unfortunately, this process heavily impacted the hotel’s operations and day-to-day functions, such as managing reservations, unlocking hotel room doors manually and using point-of-sale (POS) systems in restaurants and shops within the hotel. Some estimates expect this attack to cost the Omni over a million dollars. While unconfirmed by the hotel, several sources speculate that the type of cyber-attack was a ransomware attack similar to what happened to MGM in Las Vegas several months ago. While most customers were aware of the inconveniences of the Omni outage, many weren’t aware of the dangers associated with cyber-attacks. When a network is compromised, unless you have high-grade tools to protect you, every device you connect to is put at risk. When you’re traveling, it’s important to treat everything like a risk to ensure your safety. In today’s article, we’re sharing a couple of tips to keep you safe when you’re on the road for work or even on vacation this summer. These tips will help protect you, but if you travel for work or have employees who travel for work, it’s important that all work devices have professional-grade cybersecurity tools installed on them. You don’t want to send your sales team to a hotel-hosted trade show, and instead of bringing back a list of leads, they bring back malware that could shut down your company altogether. There is one final lesson in this terrible incident that all business owners need to understand: No matter the size of the company, you can still be the victim of a cyber-attack. The Omni chain, which boasts over 50 properties nationwide, would likely have a large budget to defend itself from cyber-attacks and yet still fall victim to hackers. No system is 100% impenetrable, but small business owners who don’t have any security measures in place are putting a big red target on their backs. If you don’t have a cybersecurity system in place, or if you do and someone else is managing it but you’d like a second opinion, we offer a FREE Security Risk Assessment. This assessment will go over every area of your network to identify if and where you are vulnerable to an attack and propose solutions to fix it. Click here to book your Security Risk Assessment with one of our cybersecurity experts, or call our office at 774-241-8600.

The initial reaction when you suspect your computer or network has been compromised is to panic. However, if your network has been breached, what you do next can make the difference between the incident being a minor inconvenience and being a devastating disaster that brings legal trouble and huge fines and halts your ability to do business. In today’s article, we’ve consulted our cybersecurity experts on the top signs of an affected computer and the five steps you need to take as soon as you notice your network has been compromised to prevent as much irreversible damage as possible. Signs Of An Issue According to IBM’s latest cybersecurity report, the average data breach goes 277 days before it’s noticed and reported. This time frame sounds crazy considering that attacks using malware, viruses, keylogging tools and more can cause a considerable amount of damage very quickly, but most users miss the warning signs and don’t realize they’re under attack until irreversible damage has occurred. Several of the biggest indicators of an issue can be mistaken for a slow or outdated computer or operating system. If you experience any of these issues, it’s a good idea to contact your IT team. If it’s an attack, they’ll know the proper steps to take, and if it’s not, they’ll be able to update your system or replace your device to improve performance. Here are a few key signs your computer could be infected: What To Do Next If you’re experiencing any of these issues, the next steps you take are important. Here is what our team of experts recommends: 1. Take the network offline to isolate the incident, but DO NOT turn off the device or reboot it. When a device isn’t working the way it should, the go-to move is to hit Restart. In many scenarios, that maneuver can work; however, if malware is involved, this simple act can make the situation worse. In some circumstances, rebooting your device can set in motion a crashed file-encryption process that can cause unrecoverable data loss. Disconnect your device from the network but allow it to remain on as you move through the next steps. 2. Call your IT team IMMEDIATELY. It’s important to contain the breach before it infects the rest of your network or causes any more damage. Your IT team will be able to investigate the issue to determine what went wrong and what the impact was and mitigate the breach quickly. Do not try to fix this on your own. Attempting to run a “system cleanup” or your antivirus software will waste time and could cause more damage. Call in the experts. 3. Call your attorney. There are several reasons to call your attorney. Depending on the size of the breach, your attorney may refer you to outside legal counsel with privacy and data security expertise who can advise you on the federal and state laws that may be implicated by the data breach. 4. Change passwords and secure all accounts. As the IT team is working on containing the breach, you’ll want to change your passwords to protect any of your other accounts that may not have been affected yet. Hopefully you have multifactor authentication enabled and will be notified if someone tries to access your account, but if not, begin working through your accounts to secure them, starting with ones that contain financial information like credit card numbers, Social Security numbers and more. 5. Check your bank accounts. Nearly all cyber-attacks are financially motivated, making bank accounts the primary target. As the breach is being mitigated, check your bank accounts and payment processing tools, including third-party merchant accounts and employee payroll systems, for any anomalies or sudden changes. If you’re hit by a cyber-attack, there will be a list of other steps to take, like implementing a PR communications plan, notifying appropriate parties such as law enforcement and more. The most important thing you can do if a data breach occurs is to isolate the incident and hand it over to a qualified cybersecurity professional as soon as possible. Time matters in these situations. If you need a reliable, trustworthy cybersecurity team monitoring your business, start with a FREE Cyber Security Risk Assessment. These assessments are designed to thoroughly examine your network to pinpoint any vulnerabilities and map out a plan to fix them. It is much more cost-effective to prevent a cyber-attack than to fix one, so book your assessment today by going to www.centrend.com/contactus or calling 774-241-8600.

Horror stories of people getting scammed out of hundreds or even thousands of dollars aren’t in short supply. As we scroll through the news app from the comfort of our couch, reading these accounts of how a stupid so-and-so opened an obviously suspicious attachment and a hacker drained their bank account, it’s easy to say things like “I’d never fall for that!” But would you? The sobering truth is that, under the right conditions and with the right threat, anyone can fall victim to a financially devastating scam. This reality was recently demonstrated when a finance guru, someone armed with enough financial acumen to publicly advise others, lost $50,000 to a scammer pretending to be a CIA agent. Charlotte Cowles, a seasoned financial advice columnist for New York Magazine’s digital fashion news site, The Cut, wrote a first-person account of how she boxed up $50,000 in cash in a shoebox, walked it out to the sidewalk in front of her house and willingly handed it over to an unknown person in a white Mercedes SUV. Looking back, she was humiliated that she couldn’t see the red flags, but the way these criminals intricately plotted every step would have convinced most people. I suggest giving her detailed story a read, but to give you the nutshell version, this elaborate scam started early in the day when a woman from “Amazon’s customer service” called to inquire about unusual activity on Charlotte’s account. The woman told her this has been a frequent issue for the company, provided a case number ID and recommended Charlotte check her credit cards immediately. She shared that the issue was so prevalent that the company was working with a liaison at the Federal Trade Commission and offered to refer her to him for additional assistance. Once connected, the FTC agent provided his badge number for reassurance and a direct number to reach him at, and confirmed personal details like her full name and Social Security number. Convincing, right? That’s when things took a turn. The agent shared that he had been following her case for some time, and to date, there were 22 bank accounts, nine vehicles and four properties registered under her name. The bank accounts had wired more than $3 million overseas, mostly to Jamaica and Iraq, and he wondered if she could tell him anything about this. This crazy scheme escalated from there. The agent texted her a photo of her ID, claiming it had been found in a car rented under her name that was abandoned on the southern border of Texas with blood and drugs in the trunk and was linked to an even bigger drug raid. He told her there were warrants out for her arrest in multiple states and that she was facing heavy charges of cybercrime, money laundering and drug trafficking. She frantically googled her name, looking for any warrants. Nothing. Sensing her rising discomfort, he asked if she had recently used public Wi-Fi. She had, at the airport. “Ahh…” he said, “that’s how most of these things start.” As she texted her husband that she was in serious trouble, the agent offered her a solution, but she could tell no one. Everyone was a suspect, and they were watching her every move. The agent said her laptop was hacked, her home was being watched and they could even see her two-year-old son playing in the living room right now. At the mention of her son, she was all in to resolve the problem. Sadly, you know the heartbreaking ending of the story. She drained her savings and hand-delivered it in a floral-printed shoebox to the scammer. Here’s the real kicker: if Cowles, armed with financial acumen and a journalist’s skepticism, can be led astray, what chance do the rest of us stand? It’s a digital Wild West out there, folks, and the outlaws are on the prowl, looking for their next big score. This tale isn’t just a wake-up call – it’s a blaring siren for small business owners everywhere. If you think you’re too smart to get scammed, think again, because it’s happening all the time. When Charlotte began to share her story, everyone seemed to know someone who had gone up against a scammer and lost. One friend’s criminal-defense-attorney father had been scammed out of $1.2 million. Another was a real estate developer duped into wiring $450,000 to someone posing as one of his contractors. Even a Wall Street executive, who had been conned into draining her 401(k) by a guy she met at a bar. These stories are everywhere. Cybersecurity cannot be ignored. With the AI tools available, scams are becoming more and more difficult to identify. If you want to protect yourself, your family and your business, you absolutely MUST take your security seriously. Every day, hackers are buying and selling personal information, like Charlotte’s Social Security number, on the dark web to hackers who will use it to run scams just like this one. You or your loved ones could be next. This ISN’T meant to scare you, although it should; it’s meant to educate you and give you the upper hand to go up against these criminals. To protect what’s yours. The best way we can help is to offer a FREE Cyber Security Risk Assessment. We’ll do an in-depth evaluation of your network’s security system, including scanning the dark web for leaked information, and provide you with a comprehensive report of what you need to do to be secure. You can book your Assessment with one of our experts for FREE by going to www.centrend.com/contactus or calling 774-241-8600.

Tax season is around the corner, which means so are tax scams. Without fail, every year, individuals and business owners alike fall victim to tax scams, resulting in the loss of substantial amounts of money and sensitive personal data. According to the Better Business Bureau, taxpayers lost $5.7 billion due to tax scams and fraud in 2022 alone. In today’s article, you’ll discover the top scams you need to be on the lookout for to reduce your chances of becoming these scammers’ next victim. The IRS has specific methods of contacting you One way to lessen your chances of falling for Internal Revenue Service scams is to know how the IRS will contact you. Per the IRS website, the IRS will not initiate communication with taxpayers through e-mail, text messages or social media platforms for the purpose of soliciting personal or financial information. The IRS’s main method of communication is physical mail; however, if they’re unable to reach you via mail, they may initiate a phone call. If this is the case, they will still try not to solicit any personal or financial information over the phone, and they will never threaten you or demand payment. If you’re second-guessing anything you receive, you can check out this article to help you figure out if it’s really the IRS contacting you. Here are the top scams to keep an eye on this tax season The Refund Scam The Internal Revenue Service has issued a warning to taxpayers regarding a scam designed to deceive individuals into believing they are entitled to a refund. This is often the most common scam that we see happen every year. In this scheme, recipients receive a formal notification, usually a letter, stating that they have an “unclaimed refund” available. There are variations of this, including one scam that uses a cardboard envelope from what looks to be a certified delivery service and bears the IRS logo. Similar to many scams, the deceptive letter provides contact information and a phone number that is in no way affiliated with the IRS. What sets this scheme apart is its request for various sensitive personal details from taxpayers, including detailed images of driver’s licenses. Identity thieves seeking to get ahold of tax refunds and other confidential financial data can exploit such information. Stay vigilant and be cautious of such misleading communications. If something seems off, it probably is. Identity Theft If cybercriminals are able to get access to your personal information, they can file a fake tax return on your behalf and potentially collect a refund payment. The IRS recently shared that more than 1 million tax returns were flagged last year for possible identity theft. One tool to prevent tax ID theft is to apply for an Identity Protection PIN from the IRS before you file your return. It’s also good to file early before criminals have a chance, and if you get a notice about an alleged “duplicate tax return” or a notice saying that additional taxes are owed, contact the IRS directly as soon as possible. The ERC Scam The Employee Retention Credit (ERC), sometimes called the Employee Retention Tax Credit, or ERTC, is a refundable tax credit against certain employment taxes. The IRS and tax professionals continue to see aggressive broadcast advertising, direct mail solicitations and online promotions involving the ERC. While the credit is real, aggressive promoters are misrepresenting and exaggerating who can qualify for the credit. This has led the IRS to issue many warnings about ERC schemes from third-party promoters that charge large up-front fees or a fee based on the amount of the refund. These promoters may fail to inform taxpayers that they must reduce wage deductions claimed on the business’s federal income tax return by the amount of the credit. Businesses, tax-exempt organizations and others thinking about applying for the ERC need to carefully review the official requirements for this credit before they claim it. The “Impact Payment” Scam As you prepare to collect the required documents for filing your 2023 return, be aware of a new online scam circulating. This scheme involves an e-mail displaying the IRS logo and addressing the “third round of economic impact payments,” deeming it an “important matter concerning your recent tax return filing.” The e-mail asserts that certain inconsistencies or missing information have been identified and assures recipients that a refund of $976 awaits them upon submission of the required document. Notably, there’s a button labeled “complete my information,” but IRS Media Relations Specialist Robert Marvin urges you not to click it. The “Additional Information Needed” Scam If you receive an e-mail from the IRS requesting that you submit a tax form, proceed with caution. While there are legitimate forms that taxpayers may be required to complete (such as the W-9 for freelancers and W-4 forms for employees), these are typically directed to companies and do not go directly to the taxpayer from the IRS.[RS1]  To steer clear of potential scams, it is recommended to disregard such messages and promptly report the fraud to the IRS. It’s important to note that the IRS does not initiate contact via e-mail, and any solicitation for forms through this is indicative of fraudulent activity. Another Tax Agency Scam Scammers may adopt the appearance of legitimate or fictitious tax agencies when making phone calls. Instances include impersonating entities like the Taxpayer Advocate Service or the nonexistent Bureau of Tax Enforcement. While the Taxpayer Advocate Service is a legitimate entity, it does not initiate unsolicited calls to taxpayers. On the other hand, the Bureau of Tax Enforcement is not a genuine organization. Exercise caution and skepticism toward unsolicited calls alleging to be from government agencies. Obtain a reference number if possible, terminate the call and initiate a return call using an officially verified phone number. This practice helps protect against potential scams. Be Smart And Protect Yourself The tax season often sees a surge in scams, but with some vigilance identifying an IRS imposter and protecting your finances and