Most consumers would take their business elsewhere if they discovered an organization had suffered a major cyber-attack or data breach, according to new data from KPMG.

The global consulting firm polled over 2000 Canadians in September to better understand the impact of security incidents and the risks for online firms that fail to adequately protect customer data.

As many as 90% of respondents said they would feel wary about sharing personal or financial information with a company that had suffered such an incident, and over two-thirds (67%) are more worried than ever about their data being breached.

The findings come at a time when consumers are spending more of their lives, and sharing more of their data, online.

Over half (54%) of respondents said they are shopping more online than they used to pre-COVID, rising to 64% for the 18-44 age group. The same number (54%) said they had received a lot more suspicious emails in the first half of 2020, and even more (84%) claimed they were being “extra careful” when shopping online for fear of their data being stolen.

Phishing (38%) and spear-phishing (13%) were revealed as the most common attacks likely to face Canadians, as they are consumers in other Western countries. Unfortunately for brands, they are likely to get the blame for successful attacks on consumers even though it is the email recipients themselves who make the mistake of clicking through.

Restoring consumer confidence will therefore require a focus on internal security, to mitigate the threat of data breaches, and closer engagement with customers to educate them about the threat from phishing and social engineering attempts to impersonate their brand.

KPMG urged organizations to identify and protect their “crown jewels,” build internal resilience through incident response, improve staff training and awareness, establish governance and accountability, and help managers better understand the business impact of security.

“While social distancing has made us much more reliant on all things digital, the surge in cyber-attacks and data breaches amid the COVID-19 pandemic is starting to undermine trust,” argued Hartaj Nijjar, KPMG partner. “The new reality in which we are living demands that every organization takes a much harder look at their cybersecurity strategy, systems and protocols.”

There are major concerns for the health of patients across America and beyond after one of the nation’s largest hospital providers was struck by an apparent ransomware attack over the weekend.

Universal Health Services (UHS) claims to operate around 400 acute care hospitals, behavioral health facilities and ambulatory centers across the US, Puerto Rico and the UK.

It posted a brief statement on Monday morning Eastern Time admitting that its IT network across all UHS facilities is currently offline due to an “IT security issue.

“We implement extensive IT security protocols and are working diligently with our IT security partners to restore IT operations as quickly as possible,” it continued.

“In the meantime, our facilities are using their established backup processes including offline documentation methods. Patient care continues to be delivered safely and effectively.”

Given its reference to backup processes, the incident seems very much like a ransomware attack. It also fits the classic ransomware MO of attacking targets at the weekend when technical support may take longer to rally, and of targeting healthcare organizations that have much to lose from refusing to pay.

In fact, Microsoft revealed in April that ransomware gangs were deliberately targeting the healthcare sector during the COVID-19 crisis.

Reports on social media suggest that some patients are being redirected to other hospitals, as UHS continues to tackle the IT incident.

Fresh in the mind is an incident in Germany earlier this month when a patient died after delays to her treatment caused by a ransomware attack.

There will also be concerns about the security of patient data at UHS hospitals, given many ransomware gangs now also steal information in a bid to force payment.

However, UHS claimed: “No patient or employee data appears to have been accessed, copied or misused.”

There was a 20% increase in ransomware attacks in the first half of 2020, to top 121 million, according to SonicWall.

Daniel Norman, senior solutions analyst at the Information Security Forum, argued that the healthcare sector has an outdated approach to cybersecurity.

“With this industry adopting new and emerging technologies, the requirement to educate and train the entire workforce on a range of cyber-risks and threats is urgent. In addition, the safety and wellbeing of patients has historically been the top priority, so this mindset needs to translate into the security of systems and devices that will underpin the lives of many,” he added.

“Basic cyber-hygiene standards need to be met, covering patching and updates, network segmentation, network monitoring and hardening, especially for technologies such as AI, robotics and IoT devices. Privacy should also be a high priority for anyone handling sensitive information, considering the shift towards storing patient records online.”

Nearly half (45%) of citizens across seven countries – the UK, US, Canada, Australia, Russia, Norway and Sweden – do not trust the integrity of information they find online, according to an analysis by TunnelBear. This includes 48% of respondents from the UK.

Amongst the survey of 5500 people aged 18-65 in these countries, there was also a strong suspicion that online censorship is taking place. Over two in five (44%) reported that either they have, or someone they know has, experienced internet censorship, with this figure rising to 58% in the UK.

In addition, more than two-thirds (69%) said they felt there could be censorship taking place within their country while over one-third (35%) believe a significant amount is censored in their country.

More than a third (39%) also commented that they believe political parties and governments are engaging in political censorship in order to avoid upheaval or embarrassment. This figure rose to 44% amongst US participants.

The lack of trust in online information is especially concerning given the growing reliance on this channel as a result of COVID-19 lockdown restrictions this year.

Justin Watts, head of engineering at TunnelBear, stated: “While consumers are increasingly aware of and wary about internet censorship in the UK and globally, they also need to understand how to combat such intrusions on their freedom.”

Speaking to Infosecurity, Watts added: “The tech industry has made some astounding strides in the development of internet services over the past few years. As online services and platforms continue to evolve and play a large role in people’s lives, so does the awareness about the effects of these technologies and the importance of an uncensored lens into our world.”

Commenting on the research, Raef Meeuwisse CISM, CISA, author of Cybersecurity for Beginners, said: “There is a predictable lifecycle to the emergence, use and then misuse of new types of electronic information. Whenever new types of digital information emerge that influence or control human decisions, they become high-value targets for subversion.

“Two of the most prominent examples of information misuse have been online product reviews besieged by fake reviews and how the term fake news – once used just to label news that was provably incorrect – is now regularly misapplied to discredit or question real news more often than it is to label genuine fake news.

“With more time being spent online and attention focused on particular subjects and platforms, I think it is inherently evident that there has been more censorship – which by definition is the suppression of speech and communication. As an example, in place of social proof or popularity, some search engines and social media platforms promote what they consider to be ‘authoritative sources’ and may suppress or remove other results. Is that good practice? It really depends on how reliable the censorship decisions are – but what has been evident in many cases is that the sources that have been marginalized turned out to be correct – and the supposedly authoritative sources have sometimes turned out to be the misinformation.”