"Spear phishing" attack..

My wife's employer has just admitted that the company has been a victim to a so-called spear phishing attack, and has issued guidelines for employees to follow as regards their personal bank accounts, etc.

Surprised at the admission that it took a whole month for the attack to be noticed. Would that be regarded as "normal"?

Companies dont normally tell straight away, i think it can be hard to tell whats actually gone on? and theres also a reluctance to admit?

However it might be a crime to not notify individuals who have been affected in as timely a manner as possible.

Not realising though for a month, that's not a crime obviously. Presumably after the breach has occurred it's only going to be noticed when something is done with the information, like further attacks on several employee's. Even just a single attack wouldn't give you enough information to link it to the source as being the employer.

Data protection laws were recently updated as well weren't they?

Basically reminding small businesses that they have as much responsibility to customer data as any big company.

GDPR doesn't take effect until sometime in May I think.

The company's admitted that payroll data has been breached - name, monthly salary payment, bank account number and sort code, etc., as well as full sharesave accounts data. They've advised that the main risk is the potential for fraudsters to use the information to set up unauthorised direct debit or standing order instructions on personal bank accounts, but claim the risk is "very low".

Curious, how these risks always seem to be "very low" at first, don't you think?!

Makes you wonder why the hackers spend so much time doing it....

GDPR doesn't take effect until sometime in May I think.

Indeed and you have to inform the ICO of a breach after that date or face a fine of up to 5% of the company turnover.

Makes you wonder why the hackers spend so much time doing it....

A lot of hackers do it because they can and not necessarily for personal gain.

The company's admitted that payroll data has been breached - name, monthly salary payment, bank account number and sort code, etc., as well as full sharesave accounts data. They've advised that the main risk is the potential for fraudsters to use the information to set up unauthorised direct debit or standing order instructions on personal bank accounts, but claim the risk is "very low".

 

Curious, how these risks always seem to be "very low" at first, don't you think?!

 

Makes you wonder why the hackers spend so much time doing it....

They could also now call those people and having a lot of details they can try to trick them into handing over a pin or an online banking password.

We're calling from XYZ bank about your account 12345678 sort code 12-34-56, we just need you to confirm your online banking password to verify security and then we need to talk to you about a problem with your salary payment for this month, which we see is normal £1234.56 is that correct?