It’s been reported that Subway customers in the UK are receiving scam emails as part of a phishing attack. The emails also use the victims’ names and appear to come from the chain’s Subcard loyalty scheme.
It’s been reported that Subway customers in the UK are receiving scam emails as part of a phishing attack. The emails also use the victims’ names and appear to come from the chain’s Subcard loyalty scheme.
Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics
This is an elaborate attack. People in the UK are going to get more than their lunchtime “sarnie”* delivered.
It\’s another reminder that security awareness training, with macro downloads and ransomware simulations, can considerably reduce the risk of social engineering attacks.
To stay one step ahead, security teams should also look to war-game ransomware attacks, i.e. test what happens if an employee falls for an attack like the Subway one. By running \”what-if\” scenarios, where companies simulate the hundreds of tools employed by hackers, security teams can discover exactly what happens if an employee executes a malicious file, and proactively address system vulnerabilities in their network infrastructure before a real malware attack occurs.\”
*(colloquial English for sandwich
This is an example of why email data is so dangerous in the hands of cybercriminals. Customer databases are a treasure trove for criminals looking to launch widespread phishing campaigns, exploiting the fact that these customers already know the brand and are therefore more likely to trust the email and click through to the malware.
This attack demonstrates the implications of not sufficiently protecting valuable customer email information. For cybercriminals, email campaigns have proved such an effective and easy method of malware deployment over the past decade, if a company lets its database fall into the hands of an attacker they are putting their customers at serious risk.
To stop this they should treat email data as sensitive information and an extra layer of account security as a bare minimum, such as multi-factor authentication, to ensure that only those who should have access to an email database can access it.