Report on losses incurred by SMBs due to cyber-attacks not verified: Govt

The government on Wednesday informed the parliament that the media articles citing a report on small and medium businesses (SMB) incurring losses due to cyber-attacks cannot be verified. The government was referring to a study by CISCO which found that over 62 per cent of SMBs reported having lost more than Rs 3.5 crore due to cyber-attacks.

“The findings of such reports by the company are generally based on data generated by their products or survey of their customers. The details of such data is not available,” the government said.

Rajeev Chandrashekhar, the Minister of State for electronics and information technology was responding to an unstarred question in the Lok Sabha asking about the government’s plan to help domestic businesses to strengthen cyber security.

The government said it is aware of the increase in cyber-attacks from Chinese organisations targeting India. “According to the analysis by Indian Computer Emergency Response Team (CERT-In), the Internet Protocol (IP) addresses of the computers from where the attacks appear to be originated belong to various countries including Algeria, Brazil, China, France, Germany, Hong Kong, Indonesia, Netherlands, North Korea, Pakistan, Russia, Serbia, South Korea, Taiwan, Thailand, Tunisia, Turkey, USA, Vietnam etc,” the minister said in a written reply.

In September 2021, CISCO published a study reporting that 62 per cent of small and medium businesses in India that suffered cyber incidents said that cyber-attacks cost their business more than Rs 3.5 crore. Of these, 13 per cent said that the cost was over Rs 7 crore.

According to CISCO, the study was based on an independent, double-blind survey of over 3,700 business and IT leaders with cybersecurity responsibilities across 14 markets across the Asia Pacific region.

The survey highlighted that in India, malware attacks, which affected 92 per cent of `businesses, topped the charts, followed by phishing (76 per cent). Around 38 per cent of those that suffered incidents said that the number one cause was not having cybersecurity solutions.

Apart from the loss of customer data, businesses that suffered a cyber incident also lost internal emails, employee data, intellectual property, and financial information. In addition, businesses admitted that such attacks disrupted their operations, negatively impacted their reputation, and resulted in a loss of customer trust.