“On the scale of one to 10, this is a 20.”
-David Kennedy, CEO of TrustedSec (nbc12.com)
The global hack affecting Microsoft Exchange was first discovered in early January and has only become more serious and widespread since then. The initial breach, attributed to the Chinese hacker network Hafnium, left the software exposed to countless others who have wreaked havoc in the past several weeks. David Kennedy likens the hack to “a skeleton key to open up any company that had this Microsoft product installed.”
So far, there have been an estimated 30,000 organizations affected in the US and about 250,000 worldwide (CNN.) Most of the victims have been small organizations and businesses, from mom-and-pop shops and restaurants to local governments and healthcare providers.
The White House has declared the data breach an “active threat” and cybersecurity professionals are concerned about its economic impact on small businesses.
“I would say it’s a serious economic security threat because so many small companies out there can literally have their business destroyed through a targeted ransomware attack,” warns Dmitri Alperovitch, former chief technical officer of the cybersecurity agency CrowdStrike. (nbc12.com)
Any company that uses Microsoft Exchange could potentially be at risk. Microsoft has released security updates, but these patches do not protect from hackers that have already infiltrated a company’s system. There is no simple fix for this problem–it involves taking down the email server in order to upgrade the business’ entire “Active Directory.” Most smaller companies have limited or nonexistent IT staff and can’t afford to hire a cybersecurity firm, so this is an extremely stressful, time-consuming, and expensive crisis for affected business owners.
It must be addressed that the hack did not affect the cloud-based Microsoft 365 favored by many Fortune 500 companies. Microsoft Exchange is a much cheaper option, predominantly used by smaller organizations that can’t afford high-quality security. This illustrates the contrast between the “haves” and the “have-nots” of online security. It seems unfair that smaller businesses are hung out to dry by corporations like Microsoft, who arguably have an obligation to protect all their customers, regardless of how much they profit from them.
What to do if you have Microsoft Exchange:
These are the security measures currently recommended by Microsoft:
- Install the Microsoft security updates immediately.
- Use this tool to check for malicious activity.
- If you find malicious files, submit them to Microsoft for analysis.
Not sure how to respond to bad reviews? Click here for a copy of our Free Negative Review Response Guide.