0

Our company suffered a phishing attack yesterday. While investigating about the attacker and the potential employees of ours who might have been phished, we ended up with the attacker database of phished users.

This database include user email and passwords (~40) from multiple companies (~10) who seems to be sharing the same phishing attack as us. Moreover, it seems that the target are high profile.

So far, here is what we have been accomplishing :

  • Contact targeted companies and list phished users
  • Contact websites where the phishing attack is happening (it is happening on multiple hacked websites so it's hard to stop it)

However, we're not sure this is the best way to deal with the following situation, here is why :

  • More and more users still enter their credentials and this is not our role to secure other companies users and we would like to stop wasting time on this (most of the companies following up to our email or calling us asking for more details).

  • We are worried that some companies (targeted companies being in the same industry as us) might not understand us well and think we are in some way associated to that phishing attack because we are one of their competitors

  • We are doing security for our competitors (so we're spending money for them)

One solution could be to publish a blog post but it has downsides too such as being seen as a toxic player because we would be pointing fingers at our competitors security. Another solution would be not to contact this companies and let them get compromised.

What would be the best way to react to this phishing attack ?

  • So the attack is ongoing, and the database that you have access to keeps updating with new victims? – schroeder Sep 19 at 9:44
  • @schroeder exact – Xavier59 Sep 19 at 9:49
2

This sort of thing needs to be handed off to law enforcement to handle if it is on-going.

  • Notify victims, then let them handle it.
  • Notify hosters, then let them handle it.

Do not go public about an on-going attack with active victims.

As much as you want to fix this, and have the skills to fix this, you have to respect the boundaries of responsibility that you have. You can't make the fix happen.

  • The targeted companies are from different countries but I guess that I should only report it to our local authorities (where our company is registered) and let them handle the rest ? – Xavier59 Sep 19 at 9:56
  • That's the idea. Or the LE of the country where the database is, if applicable. – schroeder Sep 19 at 9:57
0

If you are in the US and the bad actors and their other victims are outside your state, or international I recommend you contact the FBI cyber crimes unit nearest you. That have the jurisdiction and processes to handle this. Second; you should inform your company legal counsel. They will want to now and will help with managing the risk to your company.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.