Slashdot Mirror
Nigerian Man Charged in Hacking of Los Angeles County Emails (theguardian.com)
A 'mere' 10.8% phishing success rate has forced Los Angeles County to notify approximately 756,000 individuals that their personal information may have been compromised. The attack occurred on May 13, 2016 when 1,000 County employees received phishing emails. 108 employees were successfully phished. A Nigerian national has been charged in connection with the hack. From a report on The Guardian: Many large organizations would welcome a 10% success rate in their internal anti-phishing training sessions, with 30% and above being common. The 2016 Verizon DBIR suggests that 30% of all phishing emails are opened. The high number of individuals affected from a relatively low number of successes in LA County demonstrates how dangerous phishing attacks can be. The nature of the potentially compromised information is also concerning. "That information may have included first and last names, dates of birth, Social Security numbers, driver's license or state identification numbers, payment card information, bank account information, home addresses, phone numbers, and/or medical information, such as Medi-Cal or insurance carrier identification numbers, diagnosis, treatment history, or medical record numbers," said the County of Los Angeles Chief Executive Office in a statement.
A Nigerian man caught hacking?
He must be Russian.
"That's the way to do it" - Punch
I bet it was a Nigerian prince they caught.
So big hurrah for LA Counties judicial system. I am frustrated however that no entity be it private corporate, or municipality has simply said protection of our information shall come first. This thought that let's just contract with (insert name provider, likely Microsoft) for an off the shelf solution which clearly isn't secure is absurd. Now I am also not saying some municipality pay a contractor to custom design a system, we know which way that will go (see link).
DWP billing system errors add $245 million to uncollected debt
http://www.latimes.com/local/c...
Am I the only one who thinks all 'secure' networks should be on a isolated protocol e.g. email be only text with no public network dependent information. user systems with no access to the internet, and no user level login on public devices including your phone.
The price being paid for the convenience of looking up bread pudding recipes from your work station (or ranting on /. for that matter) is simply too high. Just a thought.
My company HR sent notice of required anti-phishing email training.
- The email came from someone I never heard of.
- It contained a link to an external website.
- And the external website required we log in with our domain credentials.
I ignored the notices for weeks until my boss came to my desk and made me do it. Just unbelievable.
Our company set up our mail system to insert this line into ANY incoming external email. Has helped us a LOT with reducing the impact of phishing emails...along with filtering known phishing domains......
>>Attention: This email was sent from someone outside of [your company name here]. Always use caution when opening attachments or clicking links from unknown senders or when receiving unexpected emails.
You're messin' with my Zen Thing, man.....