According to a recent report by eSentire, Business Email Compromise (BEC) attacks rose by a staggering 70% in 2024. But the real shock comes from Coalition’s cyber insurance data, which reveals that 60% of all cyber insurance claims stemmed from BEC and funds transfer fraud.
Even more alarming? When BEC attacks succeed, 29% lead directly to funds transfer fraud, with claim severity jumping 23% year-on-year. These aren’t just statistics, they represent real businesses losing millions of pounds to increasingly sophisticated email-based attacks.
The data reveals a troubling trend: whilst organisations have strengthened their defences against traditional malware, attackers have pivoted to exploiting the human element through email and compromised credentials. eSentire’s research shows that valid credentials dominated as the primary initial access vector, accounting for 48.6% of successful attacks.
This shift highlights a critical gap in many organisations’ security strategies. Traditional email filters and basic authentication are no longer sufficient when attackers are:
- Using legitimate credentials stolen from unmanaged devices
- Leveraging sophisticated social engineering through email
- Exploiting browser-based vulnerabilities that now account for 70% of malware cases
- Taking advantage of the fact that 90% of successful ransomware attacks originated from unmanaged devices
The real cost of inadequate protection
Coalition’s insurance data provides a sobering look at the financial impact. The average BEC claim resulted in £28,000 in losses, whilst funds transfer fraud averaged £148,000 in initial losses. Perhaps most telling: Coalition identified 614 businesses that chose not to address critical security issues and later suffered ransomware attacks, totalling an estimated £245 million in losses.
The solution: Layered defence for email and identity
The data makes it clear that modern cyber threats require a comprehensive approach:
Advanced email security: Solutions like Check Point Harmony Email and Collaboration go beyond traditional filtering to detect sophisticated BEC attempts, analyse communication patterns, and prevent credential harvesting through advanced threat intelligence.
Identity Threat Detection and Response (ITDR): Services like Huntress’s ITDR and SIEM provide the visibility and rapid response capabilities needed to detect when credentials are compromised and stop attackers before they can execute funds transfer fraud or deploy ransomware.
With BEC attacks becoming the dominant threat vector and email remaining the second most common initial access method, the question isn’t whether your organisation will be targeted, it’s whether you’ll be ready.
The businesses that avoided becoming part of these devastating statistics invested in comprehensive email security and identity protection. Those that didn’t learnt an expensive lesson about the true cost of inadequate cyber security.
Ready to protect your organisation from the BEC epidemic? Contact us to learn how Check Point Harmony Email and Collaboration combined with Huntress ITDR can provide the layered defence your business needs.
