FCCI Insurance Group Hacked: Business Email Compromise (BEC) Incident Review
In today’s digital age, cybersecurity is not just a concern for large corporations. Startups and small to medium-sized businesses (SMBs) are increasingly becoming prime targets for cyberattacks. The recent data breach at FCCI Insurance Group serves as a stark reminder of the risks that all businesses face and highlights the importance of robust cybersecurity measures.
Incident Overview
Between December 2023 and February 2024, an unauthorized third party gained access to sensitive information by hacking FCCI Insurance Group’s company email accounts. The stolen data included names, Social Security Numbers (SSNs), contact information, dates of birth, driver’s license numbers, and health information. FCCI notified affected individuals of the breach on June 19, 2024.
Why This Matters to Startups + SMBs
Business Email Compromise (BEC) poses a significant threat to startups and SMBs. In most cases, businesses send sensitive information via email without adequate cybersecurity protection, making them easy targets for hackers if their email accounts are compromised.
1. Security Awareness Training
Individualized training programs can significantly sharpen a workforce’s ability to identify, respond to, and report phishing and lower the risk of account compromise.
- /resources/cybersecurity-awareness-training-for-employees/The Complete Guide To Cybersecurity Awareness Training for Employees
- Top/resources/top-5-free-cybersecurity-awareness-training/5 Free Cybersecurity Awareness Training Resources for 2025
The Complete Guide To Cybersecurity Awareness Training for Employees Top 5 Free Cybersecurity Awareness Training Resources for 2025
2. Multi-Factor Authentication (MFA)
MFA is a vital security measure that adds an additional layer of protection. Even if an attacker gains access to a password, MFA can prevent them from accessing the account without the secondary authentication factor during a Business Email Compromise (BEC) Attack.
- Deploy 2-step verification (Google Workspace Admin Help)
- Set up multifactor authentication for Microsoft 365 (Microsoft Learn)
Deploy 2-step verification (Google Workspace Admin Help) Set up multifactor authentication for Microsoft 365 (Microsoft Learn)
3. Password Management
Passwords are the foundation of security, and we take their creation, management, and monitoring seriously. Our industry-leading zero-trust password manager is given to all of your employees/contractors and ensures organizational password policies are met while allowing you to audit your organization-wide and employee-specific password habits quickly. Furthermore, users benefit from automatic notifications when their passwords are found in a data breach or do not follow organization standards.
4. Data Management Practices
Data management refers to how an organization collects, stores, handles, and disposes of data. Typically, this is documented through a policy to which your employees will agree. Beyond policy, this means you should only send information containing Personally Identifiable Information (PII), Financial Information, Protected Health Information (PHI), or company Intellectual Property (IP) after first securing the data. You can do this by uploading a file to OneDrive or Google Drive and specifying the recipient. If they only need access for a limited time, you can set an expiration link for a week or a reasonable amount of time to ensure it is no longer publicly shared. Suppose you send this link via email to customers. In that case, there is no need to worry about hackers stealing sensitive information from the Sent folder if your email gets hacked like hackers did when stealing data from FCCI Insurance Group.
- Creating a Data Management Policy (WatchDog Security)
- Securely Share a File in Microsoft 365 via Email (Western Washington University)
- Share files from Google Drive (Google Drive Help)
Creating a Data Management Policy (WatchDog Security) Securely Share a File in Microsoft 365 via Email (Western Washington University) Share files from Google Drive (Google Drive Help)
Unify Cloud, SaaS, and Device Visibility in One Place
Total visibility. Zero blind spots. WatchDog helps you monitor every user, service account, and system across Cloud, SaaS, and devices -flagging misconfigurations and risks the moment they arise.
- ➕ Asset management – Add and track your own assets easily across Cloud, SaaS + On-Prem
- Identity monitoring – Limited to Google Workspace & M365 Non-Human Identities on free plan
- 🔧 SaaS + Cloud hardening checks – Spot misconfigurations before they become risks
Get started free today – no credit card required.
Additional Resources
Business Email Compromise (FBI.gov) What is business email compromise (BEC)? (Microsoft.com)
