Expert Comments

Subway Customers Receive ‘Malware’ Emails – Expert Advice

ISBuzz Staff
December 14, 2020

Malware and Vulnerabilities, Phishing

It’s been reported that Subway customers in the UK are receiving scam emails as part of a phishing attack. The emails also use the victims’ names and appear to come from the chain’s Subcard loyalty scheme.

Experts Comments

December 14, 2020

Colin Bastable

CEO

Lucy Security

This is an elaborate attack. People in the UK are going to get more than their lunchtime “sarnie”* delivered. It's another reminder that security awareness training, with macro downloads and ransomware simulations, can considerably reduce the risk of social engineering attacks. To stay one step ahead, security teams should also look to war-game ransomware attacks, i.e. test what happens if an employee falls for an attack like the Subway one. By running "what-if" scenarios, where companies simulate the hundreds of tools employed by hackers, security teams can discover exactly what happens if an employee executes a malicious file, and proactively address system vulnerabilities in their network infrastructure before a real malware attack occurs." *(colloquial English for sandwich Read Less

December 14, 2020

Ed Macnair

CEO

Censornet

This is an example of why email data is so dangerous in the hands of cybercriminals. Customer databases are a treasure trove for criminals looking to launch widespread phishing campaigns, exploiting the fact that these customers already know the brand and are therefore more likely to trust the email and click through to the malware. This attack demonstrates the implications of not sufficiently protecting valuable customer email information. For cybercriminals, email campaigns have proved such an effective and easy method of malware deployment over the past decade, if a company lets its database fall into the hands of an attacker they are putting their customers at serious risk. To stop this they should treat email data as sensitive information and an extra layer of account security as a bare minimum, such as multi-factor authentication, to ensure that only those who should have access to an email database can access it. Read Less

Submit Your Expert Comments

What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Write Your Expert Comments *

Your Registered Email *

Notification Email (If different from your registered email)

* By using this form you agree with the storage and handling of your data by this web site.

SUBMIT