My entire company got hit by a phishing attack in one afternoon last Tuesday

It started with an email that looked exactly like our HR portal asking everyone to update their direct deposit info. Within 3 hours, 12 people had clicked the link and entered their login credentials including me. Our IT guy caught it when he noticed the domain was off by one letter, hr-portal instead of hrportal. By then the attacker had already accessed payroll files and sent fake wire transfer requests totaling $14,000. Has anyone else dealt with a spear phishing campaign that targeted your whole team at once?

2 comments

2 Comments

patriciaellis10d ago

We set up two-factor authentication after that happened to us...

julia_burns910d ago

Oh man, that reminds me of the time our office fell for a fake pizza delivery link (classic mistake, I know) and ended up ordering 50 pizzas we never got.

-1