DocuSign Database Breach
Background:
DocuSign recently acknowledged a breach in their systems in which a database containing email addresses was compromised. No personal information was leaked, only the email address on file with DocuSign.
What you should know:
Computing Services and Systems Development (CSSD) is responding to a new email phishing scam that claims a wire transfer from DocuSign is ready for your signature. The Subject line of the email typically reads: “Completed: docusign.com – Wire Transfer Instructions for recipient-name Document Ready for Signature”. The email contains a link to a downloadable Word document that is designed to trick the recipient into running harmful software.
Another threat that has come out of the breach is a phishing scam involving DocuSign. Some have seen emails which appear legitimate stating to login to complete or view forms. This link in the email takes them to an illegitimate DocuSign login page. If the person logs into this page, it inadvertently provides their DocuSign credentials to the hackers.
Surge in Wire Transfer Fraud
Background:
Attempts at cyber wire fraud globally, via emails purporting to be from trusted business associates, have surged in the last several months. The total number of business email compromise cases almost doubled from May to December of last year, rising to 40,203 from 22,143.
What you should know:
These requests are coming from an email address that may or may not be similar to the company requesting the wire transfer, however, they are changing the “Friendly From” name to a CEO, or someone you may have received a similar request from previously. Because these come from a legitimate email address, these cannot be stopped with technology, such as email spam filters.
What you should do:
-Any request for a wire transfer should be followed by a voice confirmation initiated by the person who received the request. If you get an email from anyone asking for a wire transfer, pick up the phone and call them on a previously known phone number (not one supplied via the email) and confirm the wire transfer request.
-Never send wire transfer instructions over email.
*If you receive anything suspicious please contact one of the members from the Windward team*