Slashdot Mirror
Breach at DocuSign Led To Targeted Email Malware Campaign (krebsonsecurity.com)
Digital signature service DocuSign said Monday that an unnamed third-party had got access to email addresses of its users after hacking into its systems. From a report: DocuSign, a major provider of electronic signature technology, acknowledged today that a series of recent malware phishing attacks targeting its customers and users was the result of a data breach at one of its computer systems. The company stresses that the data stolen was limited to customer and user email addresses, but the incident is especially dangerous because it allows attackers to target users who may already be expecting to click on links in emails from DocuSign. [...] In an update late Monday, DocuSign confirmed that this malicious third party was able to send the messages to customers and users because it had broken in and stolen DocuSign's list of customers and users.
I use DocuSign on a regular basis for work and have received over 20 fake emails in the last few days. These emails are particularly well drafted (as far as phishing emails go) and are easily mistaken with the real thing. DocuSign has yet to send out any warning message to its customers. Pretty poor handling from their part...
What they should *immediately* do is expire all passwords and force users to reset their password on next login.
You think the fishers won't send emails to users saying "Your password has expired. CLICK HERE to change it."?