Sextortion: A Growing Threat to Business Leaders

Corporate sextortion attempts are becoming increasingly sophisticated as cybercriminals find new ways to target and infiltrate businesses, targeting both individual employees and the company as a whole. In some instances, they are reaching out to family members and friends of employees, threatening to share harmful or incriminating information if they don’t comply with requests, such as installing files on company devices, sending money, or even asking for sexual favour’s in some cases. A sextortion threat usually starts with an email. Here’s what you need to know.

How Sextortion Threats Target Businesses

When cybercriminals are unable to get to business executives and their data through the company network, they may target their friends and family members as a way in. They could threaten them, as discussed above, but might also threaten to tell their loved ones about sexual orientation, illicit affairs, or other embarrassing information if they don’t share passwords or other access to business networks.

Businesses should have a clear policy that encourages those who are targeted to alert IT or the cyber security team right away without fear or risk of job loss.

Asking for Access is Dangerous

In the past, sextortion attempts went after money or sexual favours in exchange for keeping secrets about the victim. Now, cybercriminals are increasingly asking for straight up for access instead, demanding passwords, file downloads, and other ways to get into the network. Businesses should know that this puts them at risk of severe financial loss and the target being much more far-reaching.

By going after smaller targets at the outset, cyber attacks can get to bigger targets, potentially hacking into the company database, gathering customer data, and finding ways to get into the networks of suppliers as well. This can be incredibly damaging to individuals and companies.

Cyber and Physical Security are a Must

Executives in a business need online protection for assets and brand reputation, but it’s also important to consider adding physical security as well. Because senior leaders in a company often make their email and title public, they are targeted more often. Hackers assume these individuals have access to finances and business data that they can coerce them or their loved ones into sharing.

For this reason, companies need to assess the sextortion risk for their employees, adding the necessary protection for each of them. As cyber attacks become more sophisticated, executives and public figures are often approached in person or spied on as cybercriminals attempt to get the data they are after. They might also place bugs on their personal devices, using information gathered for online blackmail. This protection should also cover the employee’s family members, which is especially important if staff work from home, where their personal network could be infiltrated.

Create a Reporting Policy

In the majority of cases, hackers don’t have any of the incriminating videos or photos they claim to have. But the cyber security team still needs to know about the sextortion attempt. Sometimes, employees may feel uncomfortable making such reports as it can be embarrassing. They might also fear losing their job over the incident. That’s why businesses need a safe policy that allows sextortion threats to be reported and investigated without fear of the consequences.

Reports should be kept confidential while also assessing future risks. A clear, written policy for dealing with sextortion threats should be part of the new hire training process and should be kept on hand for reference when needed.

Summary

Sextortion is a sensitive situation and can be uncomfortable for all involved. However, cybercriminals aren’t backing down anytime soon and will continue to evolve their tactics for targeting those they feel will meet their demands, monetary and otherwise. Companies need to be on heightened alert for such threats and have a clear and precise plan for preventing and dealing with threats. This prevents financial and emotional damage and protects the reputation of the individual and the company.