Incident response to a medium scale phishing attack whereas the targets are not from our company?

Question

Our company suffered a phishing attack yesterday. While investigating about the attacker and the potential employees of ours who might have been phished, we ended up with the attacker database of phished users.

This database include user email and passwords (~40) from multiple companies (~10) who seems to be sharing the same phishing attack as us. Moreover, it seems that the target are high profile.

So far, here is what we have been accomplishing :

• Contact targeted companies and list phished users
• Contact websites where the phishing attack is happening (it is happening on multiple hacked websites so it's hard to stop it)

However, we're not sure this is the best way to deal with the following situation, here is why :

• More and more users still enter their credentials and this is not our role to secure other companies users and we would like to stop wasting time on this (most of the companies following up to our email or calling us asking for more details).

• We are worried that some companies (targeted companies being in the same industry as us) might not understand us well and think we are in some way associated to that phishing attack because we are one of their competitors

• We are doing security for our competitors (so we're spending money for them)

One solution could be to publish a blog post but it has downsides too such as being seen as a toxic player because we would be pointing fingers at our competitors security. Another solution would be not to contact this companies and let them get compromised.

What would be the best way to react to this phishing attack ?

Answer 1

This sort of thing needs to be handed off to law enforcement to handle if it is on-going.

• Notify victims, then let them handle it.
• Notify hosters, then let them handle it.

Do not go public about an on-going attack with active victims.

As much as you want to fix this, and have the skills to fix this, you have to respect the boundaries of responsibility that you have. You can't make the fix happen.

Answer 2

If you are in the US and the bad actors and their other victims are outside your state, or international I recommend you contact the FBI cyber crimes unit nearest you. That have the jurisdiction and processes to handle this. Second; you should inform your company legal counsel. They will want to now and will help with managing the risk to your company.