The News: A recent investigative report by CBS Chicago highlights a disturbing trend: hackers are increasingly ignoring the “big fish” to focus on local small businesses. The report follows several Chicago-area owners who saw their bank accounts drained and their operations frozen in a matter of hours. For these owners, the impact isn’t just a line item on an earnings call—it’s a “devastating” event that often leads to permanent closure. One expert in the report noted that small businesses are now the “ideal target” because they have high-value data but “low-value” defenses.
The Expert Take: This report perfectly illustrates a core concept of the NIST CSF 2.0 “Identify” (ID) function: Risk Assessment. Most local business owners assume they are “invisible” to hackers. In reality, hackers use automated bots that scan the entire internet 24/7 looking for specific weaknesses—like an outdated router or a single employee with a weak password.
When a hacker hits a local manufacturer or a family-owned shop, they aren’t looking for a “headline.” They are looking for a quick five-figure payout because they know the owner is likely too busy running the business to have a 24/7 security team. As the report points out, once the money is gone from a business account, it is often gone forever.
3 Critical “Local Business” Warnings:
- The “Invisible” Scanner: You don’t have to be “targeted” to be a victim. If your office has an internet connection, you are being “probed” by automated scripts every single day.
- The Business Account Myth: Unlike personal credit cards, many business bank accounts do not have the same level of fraud protection. If a hacker initiates a wire transfer from your business account, the bank may not be liable for the loss.
- The “Double Disaster”: For a small business, a hack is a double hit. You lose the money stolen from your account, PLUS you lose the revenue from being unable to operate while your systems are locked.
How to Protect Your “Main Street” Business:
- Separate Your Banking: Use a dedicated, “hardened” computer for all business banking. Never use that computer for checking personal email or browsing the web.
- Turn on Positive Pay: Talk to your bank about “Positive Pay” or similar services that require you to manually approve any check or wire transfer before it clears.
- Employee Training is Shielding: The report mentions that many breaches start with a simple phishing link. Make sure your staff knows that a “quick request” for a password or a wire transfer from the “CEO” is almost always a scam.
Original reporting via: CBS News Chicago