Four in ten (40%) Irish businesses have suffered at least one cyber-attack in the last five years, with companies facing financial loss as a result.
Research from insurance broker and risk management company Gallagher in Ireland has revealed that more than one in eight (88%) Irish businesses have suffered financial loss and commercial disruption due to a cyber-attack in the last five years.
Gallagher commissioned a survey of 300 business decision makers across the UK & Ireland, 100 of whom are based in Ireland.
Businesses that have experienced a cyber-attack in the last five years reported additional consequences as a result including:
- the loss of intellectual property (26%)
- supply chain disruption (23%)
- reputational damage (23%)
- ransom payment demands (20%)
Laura Vickers, Director, Gallagher in Ireland spoke of the findings,
“Given what we can see from the widespread impact of cybercrime, it is unsurprising that almost every Irish business leader we asked (93pc) said they are concerned about the rise in cyber-crime and the potential impact it could have on their company”.
The Top 3 in Corporate Cybercrime
- Cyber extortion, whereby cyber criminals threaten to harm a business or steal sensitive information unless a sum of money is paid, was the most common type of attack carried out on Irish businesses, with 37% saying they had been targeted.
- Phishing attacks, where individuals are tricked into following a malicious link or downloading an infected email attachment, was the second most common attack with 31% suffering this type of incident in the last five years.
- Followed by what is termed “Man-in-the-Middle (MiTM) attacks”, where the perpetrator intercepts and alters communication between two parties without their knowledge – 23pc of business leaders said their organisation had fallen foul of this.
In Ireland the Gallagher report reveals that large businesses, those with annual turnover exceeding £10m, have been particularly vulnerable, with 57% experiencing cyber-attacks during this period. Mid-sized companies also show substantial exposure, with 39% reporting attacks. Comparatively, smaller businesses have been less frequently targeted, with only 9% experiencing attacks.
Prepare and Respond
Despite the increasing risk of cyber-attacks, 90% of Irish business leaders express confidence in their ability to recover quickly. This optimism may stem from the fact that 94% of businesses have a cyber insurance policy, with 89% confirming their coverage includes risk management, including vulnerability scans and threat monitoring,to mitigate potential threats.
However, the Gallagher survey also highlights areas of concern within Irish business
- Just 39% of companies provide cybersecurity training for staff, leaving many employees susceptible to phishing and malware attacks.
- Only 41% conduct regular system vulnerability scans, increasing the risk of undetected weaknesses being exploited by cybercriminals.
- Less than half (48%) have multifactor authentication (MFA) in place for remote workers, potentially exposing their systems to unauthorized access.
- Only 42% of business decision-makers are aware that reporting a cyber-attack to the National Cyber Security Centre (NCSC) is a legal requirement. Failure to comply could result in fines of up to €10 million or 2% of global turnover.
Ms. Vickers went on to comment,
“While it’s encouraging to see businesses investing in cyber insurance and risk management, security measures must go beyond just financial protection. Many businesses are still vulnerable due to gaps in employee training, system monitoring, and access controls. Cyber threats are evolving rapidly, and companies that fail to strengthen their security posture risk serious financial and reputational damage.
Equally concerning is the lack of awareness around reporting obligations. Failure to report an attack could lead to significant fines, compounding the financial losses from a breach. Businesses must take a proactive approach, not just in purchasing insurance, but in implementing robust cybersecurity practices and ensuring compliance with legal requirements.”
