Spear-Phishing Season Is Declared Open

Friday, April 08, 2011

PCI Guru


With the Epsilon breach announcement recently, it seems every merchant under the sun is notifying their customers of the expected onslaught of electronic mail messages asking for bank account and credit card numbers among other personally identifiable information (PII). 

Just in the last two days, I have received at least a half a dozen messages informing me of this possibility.

The result of this breach is likely to be the best spear phishing attack we have seen to date. 

These phishing attacks will likely be highly targeted since the people that took the information from Epsilon know not only your name and email address, but also the merchant that the email address belonged. 

While Epsilon states that only names and email addresses were taken, I would also think that all sorts of demographic information necessary to make these attacks very focused was also obtained. 

That will mean the percentage of people responding to them will likely be higher than usual because of the level of detail that the attacks will be able to rely upon for targeting. 

As a result, a lot of credit card numbers will likely get exposed. So let us be prepared. 

Even though you send out messages to your potentially affected customer base warning them of this possibility, there will likely be a lot of your customers that will end up getting caught in whatever scams get dreamed up. 

Therefore you probably need to get your legal counsel up to speed as Epsilon and your company will likely end up embroiled in lawsuits regardless of the amount of warnings you issued.

Cross-posted from PCI Guru

Possibly Related Articles:
scams Social Engineering Personally Identifiable Information spear-phishing Epsilon Targeted Attacks
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.