August 31, 2018
No, you’re not being paranoid. Yes, that urgent email from the CEO actually is an unscrupulous directive from a hacker, Business Insider reported on August 31.
Indeed, the number of hackers who are breaching business firewalls to send employees messages “signed by management” is suddenly soaring—and this kind of “pranking” can create serous issues. At least, that’s what researchers from global telecommunications company Verizon found in a 2018 Data Breach Investigations Report published earlier this year.
The cybersecurity report, which analyzed over 55,000 data breaches and hacking attempts across 65 countries, discussed the rising trend of financial pretexting—cyber scams where hackers obtain the email accounts of high-level business executives, or use email addresses with usernames and domains very similar to the managers in question.
Fully 76% of these breaches are financially motivated, according to the report—and nearly 73% are perpetrated by outsiders. Members of organized criminal groups are behind half of all breaches, with nation-state or state-affiliated actors involved in 12%.
Not all the baddies are outsiders though. Over one-quarter (28%) of attacks involved insiders. The insider threat can be particularly difficult to guard against—it’s hard to spot the signs if someone is using their legitimate access to your data for nefarious purposes.
Who are their favorite people to scam? Managers in Finance and HR.
Finance employees get an email from a scammer posing as the CEO, requesting a wire transfer of cash or that fake invoices to be processed.
As for HR staff, scammers email them requesting confidential employee information, such as salary, the report noted With this information, scammers—now pretending to be the employee—then file fraudulent tax returns and send the refunds to their own bank accounts.
According to the report, pretexting scams have tripled since last year to hit 180 in 2018. This big jump is due to a surge in attacks directed at HR staff, whom other studies say, often are not trained to protect data.
Research contact: @VZEnterprise