1

My Mother received an e-mail, from some unknown mail adress. The content of the mail, was: "Hello you should look at this: ... " After this there was an old email correspondence with her lawyer, not really sensitive data, but still. There was a .zip file attached, the file name beeing some long number. She didn't try to open it or anything.

She is confident with computers, so she would not click on suspicious links in mails and not enter her passwords somewhere easily (of course you can always fall for something, but i don't belief she did). She also uses a password manager with good passwords for every account.

How could the content of the mails have been leaked? And what are steps to take now?

Improve this question
3
  • It could have been leaked by compromising the lawyer's email ...
    – schroeder ♦
    Commented Oct 2, 2020 at 12:05
  • We already contacted them, they have not yet responded.
    – Arikson
    Commented Oct 2, 2020 at 12:13
  • Keep in mind that email is NOT a secure communication mechanism. Until very recently most server-to-server email relays were not encrypted, anyone in the network path could scrape the clear text content. A few years back Google initiated a strong push to force encrypted federated relays. They had great success when they stopped accepting non-encrypted connections. Now the vast majority of relays are encrypted for transit, but not at rest. So let me emphasize again, email is NOT a secure communication protocol unless you encrypt your content.
    – user10216038
    Commented Oct 2, 2020 at 23:51

1 Answer 1

Reset to default
1

How could the content of the mails have been leaked?

This is a known strategy of the Emotet malware campaign, see Emotet is back, it spreads reusing stolen email content. The lawyers system was likely compromised by the malware and details of a previous mail exchange were used to bypass filters and gain trust of the victim.

And what are steps to take now?

Consider the lawyers system compromised and thus communication with the lawyer and shared personal information compromised too. How relevant this is and which steps need to be taken for further protection depends on the sensitivity of the data shared with the lawyer. Depending on where you live this kind of compromise might also be relevant in the scope of data protection laws, i.e. GDPR etc.

Improve this answer
1
  • You were right, the lawyer got their system checked and it was infected. Thank you for your response!
    – Arikson
    Commented Oct 8, 2020 at 18:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .