The risks of cybercrime are absolutely staggering and business isn’t prepared.

In fact, the global losses from cybercrime, which the Center for Strategic and International Studies reports have reached $600 billion annually, are devastating for victims. But it’s often difficult or impossible to recover the stolen money from the hackers who commit crimes across borders. The culprits -- if they can even be identified -- are often bad actors who are beyond the reach of governments' law enforcement.

To give you an idea of how bad the situation has gotten, the country which is perhaps the least technically advanced in the world – North Korea, is responsible for the largest bank cyber-heist in history. Even though North Korea barely has electricity, it has devoted tremendous resources to hacking.

Their Bureau 121 is their cyberwarfare agency and hundreds of the country’s most talented computer experts are sent to countries around the world where they need to hack to survive. Experts have called them dangerously good.

In 2016, it was determined North Korea was linked to the $81 million Bangladesh Cyber Heist. We first reported on this incident in May of that year and surmised it was a preventable attack. Our determination later proved correct as it turns out the institution knew they were unprepared but didn’t get a chance to boost their cybersecurity before the hack.

Amazingly, the attack could have been far worse – around a billion dollars would have been taken if instructions hadn’t been misspelled.

The link to North Korea was made by security researchers at the firm Symantec. In looking into the attack on the bank in Bangladesh, the researchers found a rare piece of code that has only ever been found in two other hacker attacks: Sony Pictures in December 2014, and media companies in South Korea in 2013. The FBI has said North Korea was responsible for the Sony Pictures attack.

Now the bank wants to get its $81 million back. The New York Federal Reserve is assisting Bangladesh’s central bank in a lawsuit filed Thursday to claw back $81 million in funds stolen during a 2016 North Korean hacking campaign. But they’re not going after Pyongyang directly.

Instead, Bangladesh Bank is suing a bank in the Philippines where the funds briefly landed before a complex series of transfers that diverted them to Filipino casinos after which they became untraceable. The New York Fed, which was holding the money when it was illegally transferred, is helping, including by urging people and organizations in the Philippines to help recover the funds, according to an agreement between the banks. 

The case -- which represents one of the biggest bank heists in modern history -- demonstrates a supreme challenge facing cybercrime victims.

Companies looking to get back significant losses will go after almost anyone they can because quite often, the real attackers are out of reach.

The situation is very scary for all sorts of companies who don’t even realize they are being used as part of a greater scheme to steal money or information.

The weakest link in any company’s cybersecurity is workers who accidentally click on an email or a social media message. Even the best-designed networks can be breached in this manner. We suggest every company use a phishing simulation tool which tests employees. One alternative, Phish360 is so effective, it has achieved almost 100% click rate when used in various organizations.

The good news is the workers who click can be quickly trained on what to avoid in the future.

Here are other areas all organizations looking to promote a cybersecurity culture need to focus on:

1.Cybersecurity training must be done regularly.

2.Auditing and documentation must be performed regularly to ensure systems are secure.

3.Anomaly detection should be running constantly to detect threats as they emerge.

4.Penetration testing shows if systems can easily be reached from the outside. Here is a case where this test might have saved two company’s’ reputations from being destroyed.

5.Network forensics for when a breach eventually occurs. The bad guys always seem to get in eventually.

6.An action plan to follow when a breach does occur. Once it happens, few will have the clear heads needed to “wing it” correctly. Equifax botched it’s response in what is being called a PR catastrophe.

7.To ensure your organization is safe – even if you have internal IT, hire an experienced MSP or MSSP like Apex Technology Services.

It’s a dangerous world. Every company must be proactive to stay secure.