Framework Computer has revealed that it has suffered a data breach affecting an unknown number of customers after its accounting services provider, Keating Consulting Group, fell victim to a phishing attack.
According to the company, an accountant at Keating Consulting was duped by a phishing emailon January 11th, in which the attacker presented himself as the CEO of Framework. The victim gave the attacker a file containing personal customer information (regarding amounts owed for purchases at Framework).
See also: HMG Healthcare: Confirmed data breach
“On January 9, at 4:27 a.m. PST, the attacker sent an email to the accountant, impersonating our CEOreceivable information accountsregarding outstanding balances for Framework purchases,” the company says in notification letters sent to affected individuals.
“On January 11 at 8:13 AM PST, the accountant responded to the attacker and provided a spreadsheet with the following information: Full Name, Email Address, Balance Due. Please note that this list was primarily a subset of open pre-orders, but some completed orders with pending invoices were also included in this list.“.
According to Framework Computer, its chief financial officer notified Keating Consulting leadership of the attack, only becoming aware of the breach about 29 minutes after the accountant responded to the attacker's emails.
An investigation into the incident was immediately launched and Framework identified all customers affected by this data breach.
See also: Fidelity National Financial: Data breach affects 1.3 million people
As we said above, the stolen data includes customers' names, their emails, and some other information that could be used in phishing attacks against customers.
It is worth noting that the company only sends emails from 'support@frame.work', asking customers to update their details when a payment has failed. It also never asks for payment information via email. Therefore, customers should be very careful if they receive an email from another similar address or if someone asks them for personal information. Anyone who receives a suspicious email should report it to the company.
Framework says that from now on, all Keating Consulting employees with access to Framework client information will have to have mandatory phishing training.
“We are also checking their standard operating procedures regarding information requests,” the company added.
Phishing protection
First, it's important to always be cautious when receiving emails .Avoid clicking on suspicious links or downloading files from untrustworthy messages.
Second, regularly update your computer's security software . This may include updating your operating system, web browser, and antivirus.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: 23andMe: Blames customer victims for data breach
Third, it's important to use different passwords for different accounts. If one password is leaked, then attackers won't be able to access all of your accounts.
Fourth, use multi-factor authentication, where available. This adds an extra layer of security by requiring additional information to log into an account.
Finally, stay up-to-date on the latest phishing and stay informed about current threats. Knowledge is the best defense against scams.
Source: www.bleepingcomputer.com
