What is it like for a small business when your website gets hacked?

60% of British small businesses experienced a cyber security breach in 2013, and the after-effects can linger.


“I couldn’t believe it, my website had been hacked again,” says Marianna Kolokotroni. “I was just staring at a black screen and couldn’t get past it.”


The owner of Oliveology, which sells products sourced from Greek artisan farmers, had just returned from holiday, and logged on to her website to tell customers that their orders would be shipped the next day, and to remind them that she would be at her stall in London’s Borough Market later that week.


Kolokotroni got stuck, because her website had been hacked. “It was so stressful. Not a lot of business comes from my website, maybe 20 or 30%, but I think it’s unprofessional if a customer were to try to access it and they couldn’t,” she says. “It basically ruined my holiday.”


According to the latest statistics from the Department for Business Innovation and Skills (BIS), 60% of small businesses had a cyber security breach in 2013, slightly down from 64% in 2012.


Malicious software (malware) is increasingly the method being used for these attacks, accounting for 45% of the breaches. However, the cost of the worst breaches for small businesses in the UK doubled in 2013, with average costs between £65k and £115k.


“I was planning on spending money on it in the coming year, but I’m going to have to do it sooner than I planned.” In the meantime, she has had to disable features on the site, including her blog, to make it secure and get it up and running again.


Kolokotroni, and millions of small business owners like her, are having to get to grips with a world where they may be as appealing to hackers as richer, bigger companies.


“Small businesses need to understand that they’re in business because they have a good idea, and that’s valuable. A small business could also be used as a stepping stone to another organisation or person you have contact with,” says David Emm, Senior Security Researcher at Kaspersky Lab.


For example, as a small business grows, so too does its customer base, and the amount of information that is stored on the website, such as user names and passwords. This is valuable because according to Ofcom, 55% of adults admit to using the same password for most, if not all, websites they register with.


His advice is for all small business owners to think about what they have that might be valuable to somebody else. For example, it could be the web server, email or customer details.


They then need to think about cyber security in the same way that they think about the security of buildings: find your weak spots, then ways to block them – which may be where anti-malware, anti-spam and firewall software come in.


If an attack unfortunately still happens, the key is to ascertain exactly what happened, and find out if someone has accessed customer or corporate information. Emm advises businesses that they should reach out to their customers and recommend them to change their passwords as a security measure, then speak with the police who may have information on the criminals and can advise on next steps.


To help small business owners understand more about cyber security, BIS launched Cyber Essentials in July 2014. Now businesses can apply for a scheme to guide them on how to protect their business from a cyber attack. Once completed a cyber essentials badge can be placed on your website to show customers you take cyber security seriously.


“We already spend more online than any other major country in the world, and this is in no small part because Britain is already a world leader in cyber security. Developing this new scheme will give consumers further confidence that business and government have defences in place to protect against the most common cyber threats,” said Universities and Science Minister David Willetts at the time.


Even so, embarrassment is still something that small businesses struggle with when dealing with the aftermath of a cyber attack. David Dexter, owner of estate-planning firm Lincoln Wills, logged on to his website one day to find a black screen with the words ‘Your website has been hacked’ in multi-coloured text.


“I felt pretty sick,” says Dexter, although he tried to make light of the situation on his Twitter account at the time, suggesting that someone desperately wanted a will. Still, he admits that if a customer had tried to visit the website before it was fixed, it would have been damaging to his reputation.


“It could have been the end of the awards, and I’m not exaggerating. If businesses couldn’t put their application in, we couldn’t have a ceremony,” she says. “We had to extend the deadline, but now we’re running on a very tight timeline because of it.”


The key is admitting that a security breach may have happened, says Emm, who notes that when businesses don’t admit there has been a problem, it can have a knock-on effect for customers and other organisations connected to the business alike.


“A good analogy is a shop. If you take something back because it’s faulty, the shop could say it has nothing to do with them or they could say, ‘Okay, there’s been a problem and we’re going to help you handle it’. You look like a good company to do business with then.”


Unfortunate though it may be, telling customers about a cyber attack and dealing with its consequences are “just part of the world we live in now”.



The guardian.com