Hardly a day goes by without yet another report of a high-profile cyber security breach affecting Indian firms. And the incidents are rising.
India saw the average cost of a data breach reach an all-time high of Rs 19.5 crore in the first half of 2024. According to a report published in The Hindu, Indian businesses face over 3,000 cyberattacks per week, only second to Taiwan firms. This escalating threat landscape pressures Indian firms to protect their digital assets and customer data. Experts say that India needs to focus more on cybersecurity as the main piece of legislation governing cybercrime is the Information Technology Act 2000 … now, 24 years old and outdated.
With the increasing use of digital platforms and sophistication of attacks, cybersecurity has become a crucial issue for accounting professionals in recent years as they hold large amounts of confidential financial data from their clients that no outsider should access. Needless to say, accounting firms comprise one of the most targeted sectors by cybercriminals.
For chartered accountants, breaches of information security can lead to catastrophic results, including regulatory actions, negligence claims, inability to meet contractual obligations, and a damaging loss of trust among clients and stakeholders.
According to IBM, professional services, such as accounting (by accounting firms), can incur an average cost of $4.65 million for each data breach; lost revenue makes up 38% of the entire cost of the breach, and there has been a 300% increase in cyber attack since the COVID-19 pandemic. So,standing still is not an option for any accounting practice wanting to thrive or even survive.
Take the case of Chqbook. The Delhi NCR-based fintech startup witnessed more than 2 lakh (0.2 million) credit scores being leaked a few years ago. The leaked data included usernames, contact details, and detailed loan information. Possible source points of the exposed data were the accounting companies that partnered with Chqbook. This unfortunate episode not only highlighted the lack of security of the monetary database systems, but was also a powerful wake-up call for Indian accounting firms to take cybersecurity more seriously.
Since the Chqbook incident, the relevance of cybersecurity for accounting firms in India gained momentum, simply because of the fact that the importance of client confidentiality is not just a requirement, it’s a commitment to excellence and a promise to protect those who entrust their financial lives to accountants. Building client trust is just as much as an accountant’s ability to crunch numbers, and cyber security is its vital part.
A PwC Survey on Data Privacy offering vital insights from 3,233 consumers and 186 organisations across India found 42 per cent of consumers are not sure if they will continue using the services of a company post a data breach. This proves our point that as custodians of highly sensitive financial information, ensuring robust data protection is not just about regulatory compliance, but also about safeguarding an accounting firm’s reputation.
However, even though cyberattacks bring commercial losses, disruption of operations and sometimes even business closures, a critical point here is that many of the accounting professionals have very few data security measures. This makes it easy for cyber-criminals to target small and medium-sized accounting firms due to the less emphasis they place on data security, controls and risk evaluations; they are, therefore, attractive targets for hackers than the big firms.
Moreover, senior partners at accounting firms are especially at risk since they are both effortlessly identifiable on the web and are most likely to conduct online banking transactions for their practices. For cyber criminals, it is super-easy to hijack access to accounts, as well as the security features associated with online banking.
This makes it critical for accounting firms to adhere to cybersecurity best practices to protect client records and keep their data safe from cyberthieves and online criminals.
The core cyber attacks faced by accounting firms are:
Phishing: An online scam where attackers, or “phishers,” try to get customer account information like passwords, usernames, PINs, or Social Security numbers. To protect against phishing attacks, chartered accountants should use firewalls, antivirus software and multi-factor authentication whenever possible.
Malware: It is a category of computer software that scammers trick users into downloading onto their devices. Sometimes, it can happen to a business without anyone knowing. Clicking a random link can be all it takes for malware to enter your systems. Hackers install malware on business machines so they can gain access to usernames, passwords, financial account information and more. They can use these entry points to steal valuable assets from your business.
By updating systems regularly, performing frequent security audits, educating all users, implementing layered security tools, using network segmentation, chartered accountants could reduce the risk of malware infections.
Ransomware: This category of malware encrypts sensitive data, demanding payment for its release, wreaking havoc on financial institutions, including accounting firms. To thwart the growing threat of ransomware and protect the integrity of financial transactions, chartered accountants must fortify defenses through robust cybersecurity measures, regular data backups, and employee training
Social engineering: This is a tactic that is getting sneakier by the minute. From phishing emails to imposter scams, these tactics are all about exploiting human psychology.
To prevent social engineering, chartered accountants could use tools like firewalls, anti-phishing software, and anti-malware programmes, verify email senders, regularly update your security patches, avoid resetting passwords through chat windows, don’t click on tempting links without thinking, and keep your team in the loop with regular security updates and training.
Insider threats: This is a catch-all category for threats that result from the unintentional or intentional actions of someone an organisation trusts. This includes employees and contractors with access to sensitive information. Unintentional insider cyber threats include opening the door to things like ransomware and malware. Someone with computer access at work might accidentally click, download or access a file that causes a security violation.Intentional insider cyber threats occur when someone with access deliberately tries to disrupt a company’s systems or make them vulnerable to infiltration. They might change company data on purpose or install malware to meet these nefarious end goals.
Chartered accountants can safeguard against insider threats by implementing access controls that limit employee and contractor access to the minimum required to perform their jobs; strong authentication that requires strong login credentials and multi-factor authentication to access sensitive data; security awareness training to educate employees on security risks, such as phishing attacks and social engineering tactics, and how to report potential threats; and sentiment analysis that uses AI techniques to screen for employees who might pose a threat.
Bottomline
Investing in cybersecurity is no longer optional for accounting firms—it’s a necessity. With cybercriminals increasingly targeting sensitive financial data, chartered accountants must implement strong password protocols and robust software defenses to significantly reduce the risk of breaches. All in all, by staying vigilant and adopting best practices, CAs can enhance and establish client trust in your brand.
