Our company suffered a phishing attack yesterday. While investigating about the attacker and the potential employees of ours who might have been phished, we ended up with the attacker database of phished users.
This database include user email and passwords (~40) from multiple companies (~10) who seems to be sharing the same phishing attack as us. Moreover, it seems that the target are high profile.
So far, here is what we have been accomplishing :
- Contact targeted companies and list phished users
- Contact websites where the phishing attack is happening (it is happening on multiple hacked websites so it's hard to stop it)
However, we're not sure this is the best way to deal with the following situation, here is why :
More and more users still enter their credentials and this is not our role to secure other companies users and we would like to stop wasting time on this (most of the companies following up to our email or calling us asking for more details).
We are worried that some companies (targeted companies being in the same industry as us) might not understand us well and think we are in some way associated to that phishing attack because we are one of their competitors
We are doing security for our competitors (so we're spending money for them)
One solution could be to publish a blog post but it has downsides too such as being seen as a toxic player because we would be pointing fingers at our competitors security. Another solution would be not to contact this companies and let them get compromised.
What would be the best way to react to this phishing attack ?
