Subway Customers Receive ‘Malware’ Emails – Expert Advice

By   ISBuzz Team
Writer , Information Security Buzz | Dec 14, 2020 07:02 am PST

It’s been reported that Subway customers in the UK are receiving scam emails as part of a phishing attack. The emails also use the victims’ names and appear to come from the chain’s Subcard loyalty scheme.

Notify of
2 Expert Comments
Oldest Most Voted
Inline Feedbacks
View all comments
Colin Bastable
InfoSec Expert
December 14, 2020 3:53 pm

This is an elaborate attack. People in the UK are going to get more than their lunchtime “sarnie”* delivered.

It\’s another reminder that security awareness training, with macro downloads and ransomware simulations, can considerably reduce the risk of social engineering attacks.

To stay one step ahead, security teams should also look to war-game ransomware attacks, i.e. test what happens if an employee falls for an attack like the Subway one. By running \”what-if\” scenarios, where companies simulate the hundreds of tools employed by hackers, security teams can discover exactly what happens if an employee executes a malicious file, and proactively address system vulnerabilities in their network infrastructure before a real malware attack occurs.\”

*(colloquial English for sandwich

Last edited 2 years ago by Colin Bastable
Ed Macnair
Ed Macnair , CEO
InfoSec Expert
December 14, 2020 3:21 pm

This is an example of why email data is so dangerous in the hands of cybercriminals. Customer databases are a treasure trove for criminals looking to launch widespread phishing campaigns, exploiting the fact that these customers already know the brand and are therefore more likely to trust the email and click through to the malware.

This attack demonstrates the implications of not sufficiently protecting valuable customer email information. For cybercriminals, email campaigns have proved such an effective and easy method of malware deployment over the past decade, if a company lets its database fall into the hands of an attacker they are putting their customers at serious risk.

To stop this they should treat email data as sensitive information and an extra layer of account security as a bare minimum, such as multi-factor authentication, to ensure that only those who should have access to an email database can access it.

Last edited 2 years ago by Ed Macnair

Recent Posts

Would love your thoughts, please comment.x