Cybersecurity Companies See Uptick in Business Following Suffolk Cyber Attack

Suffolk County made headlines last year when it revealed that it had been hacked, essentially forcing the county government offline. The county later indicated the initial intrusion occurred in December 2021. And it received a ransom demand for $2.5 million to get access to its data.

Those headlines and the hubbub (Suffolk says it didn’t pay) are translating into greater awareness, not that hacks could happen here, but that they have.

“Because the breach has been in mainstream media, people are inquiring, what should I protect and how should I protect it?” said Robert Mesas, vice president of sales and director of IT for Central Business Systems, an office equipment, technology and support company in Melville. “What should I be looking at and beefing up their security?”

Tom Franson, executive vice president of service operations for Hauppauge-based Custom Computer Specialists, also said cybersecurity has moved from headlines to personal concerns. Companies and government, in particular, recognize that cybersecurity is important.

“We’re seeing a significant uptick in activity and requests for managed security services from school districts, local government agencies, and small businesses,” Franson said.

The Suffolk attack is far from the first hack on Long Island, where dozens of ransomware attacks and hacks in general hit local school districts. Financial institutions and other businesses and individuals have been hit by attacks such as from malware, phishing, ransomware, and brute force.

“Right now the biggest risks for companies are their remote channels for remote workers and vendors,” Custom Computer Specialists CEO Jay Whitchurch said. “Both companies and individuals face a risk from phishing attacks.”

In phishing, you receive a link that, when clicked, lets someone else access your system. Hover over emails to make sure the email address it’s coming from matches what it says it is.

“You’re logging into a website,” Mesas said. “As you put your keystrokes in, they get your username, password and other information, like your Social Security number.”

In malware attacks, users inadvertently download software that gives others access to their computer. In brute force attacks, hackers seek out holes in firewalls and password lists. “Some of them just cause damage,” Mesas added. “They just want to take your network down.”

With ransomware, hackers encrypt data and demand money to provide access, as was the case with Suffolk. “You cannot get into those files unless you have the encryption key to unlock them,” Mesas said. “They usually ask for bitcoin. If you give them money, generally they’ll unlock your files.”

While some individuals and companies may think small fish can swim easily through the net, that’s not necessarily the case. “Quite often small companies fall into the belief that they’re too small to be hacked,” Franson said. “The hackers know this and are therefore finding it easier to hack the small companies.”

Mesas also said that small companies can be easy, if smaller, targets for hackers. “Some people ask for $500,” Mesas said, giving an example: “‘I’ve locked all of your photos.’ Every photo you’ve ever taken is on that computer.”

Franson said Custom Computer is being contacted by companies seeking to “recover from ransomware attacks.”

Still, prevention is the best plan, and there are measures individuals and companies can take to stay safer. “Make sure you have your technology updated,” Mesas said. “You can’t use a device that’s 10 years old and expect it to have security that addresses things for today’s attacks.”

Data and software are often stored on the cloud today, but it’s important to have a reliable cloud provider and strong updated firewalls. Multifactor authentication, Mesas said, is a must for protecting data. “When you go to multifactor, you get a code on your phone texted or emailed to log in,” Mesas said. “That makes things much more secure.”

Even the best-laid plans of Microsoft and experts, however, can be foiled if users let hackers in. “The most important thing is training users not to click on links they shouldn’t click on. Never send anyone your password,” Mesas said. “Train users what to look for.”

Whitchuch said that companies should “contact a qualified information technology (IT) firm” to conduct a vulnerability analysis, develop a risk mitigation plan, and help upgrade IT. “Individuals should take the time to educate themselves on how to prevent cyberattacks,” he said.

Cyber security companies typically test to make sure employees aren’t clicking on potentially dangerous links. “We send out fake ransomware emails,” Mesas said. “We can see who deleted them and who opened them.”

Companies should have data backed up on-site and off-site, as well as antivirus programs. And managed network services companies can oversee security. “Some people can’t afford to have an on-site IT department,” Mesas said. “We become your IT department.”

Still, he said, in the end, people seated at computers are the greatest threat. “You can do security, firewalls, cyber security monitoring,” Mesas said. “If a user does the wrong thing, downloads a payload onto a computer that the antivirus can’t catch, or malware, you’ve exposed your network to a malicious program.”

Franson said there are costs for precautions, but doing nothing can be the most expensive choice. “Cyber security is more expensive after being attacked than the cost of proactively establishing a strong security posture,” he said.