It was reported earlier this week that a well-used website within the chemicals industry had been fraudulently cloned with the attackers proceeding to contact chemical suppliers under the ruse of the brand. It is not known at this moment in time whether this was an attempt to gain access to chemicals or for financial gain.
Cyber security breaches like these are becoming increasingly common, with seven in ten large businesses reporting a breach or attack in 2017, with those holding electronic data on customers being 51% more likely to suffer an attack than those that do not.
In this particular instance, the website was cloned to an almost identical appearance to the genuine website with the contact numbers and emails being used also very similar. This type of tactic makes it especially difficult to verify, and easy to fall victim to, as everything appears as you would expect it.
Earlier this year, Cyber security firm, , reported that in 2017 17million Brits fell victim to cyber crime with hackers managing to pilfer 拢4.6bn from users. The losses reported weren鈥檛 just financial either, of the 17million, each victim then spent on average two days following the attack dealing with the aftermath.
From technical support scams, email phishing, website cloning, ransomware attacks and fraudulent purchases, these attempts are becoming increasingly sophisticated, targeted and convincing by the day. A few years ago, it was easy to identify a scam by the impersonal email, poor use of language or unusual looking links, however, now, fraudsters have personalisation down to a fine art, able to make plaster cast moulds of websites, corporate email communications and business stationary.
It is therefore important to take the time to check for the tell-tale signs of a suspicious email or website. This advice is fairly obvious, and 99% of businesses follow excellent digital procedures, but it is always worth revisiting the basics to prevent complacency.听
Impersonation: The most common way to trick a member of staff into revealing personal data, trust a fake purchase order or download malware is to impersonate a trusted company 鈥� this could be a bank, utilities provider, government department or company you regularly do business with.
If you receive an email which you believe is fraudulent firstly check the senders email address. Look out for generic email addresses, such as those from gmail or yahoo, or slightly off variances; for example, if an email you use regularly has suddenly changed from accounts@ to accounts.department@ it might be worth double checking. In all cases however, if in doubt, go to the company directly听and phone the main office to request verification.
Suspicious attachments: From purchase orders and invoices, to sales forms and quotes, businesses receive multiple attachments on a daily basis. If you receive an email with an attachment you were not expecting, do not open it. First, check the contents of the email 鈥� does it create a sense of urgency, is it generic and not addressed to anyone, is the language unlike what you normally see. Also, check the file extension. Attachments should be documents such as .doc, .pdf, .xls and not extensions that run script or code such as .exe, .msi, .bat, .cmd, .hta, .scr, .application etc. If you see these, best advice is to steer clear unless you're certain it is safe.
Other signs to check for are requests for an urgent bank transfer, or purchase order and invoice fraud where a 鈥渟upplier鈥� requests that their bank details are changed to a new account for future payments or a new delivery address is set up for large delivery of goods. In these instances, always use verified contact details you have on record to check with suppliers or customers and inform them when payments/deliveries will be made.听
In the chemical industry, there isn鈥檛 just the risk of financial losses. When dealing with restricted chemicals we have a strong responsibility to ensure there is no room for error and strict procedures are put in place to prevent any wrongful use of the products we supply.
This latest attempt serves as a reminder that we shouldn鈥檛 be complacent, as human judgement and error is fundamental to the success or failure of these attacks. We need to keep communications open in our industry and share breaches, attempts and threats, in order to work together and reduce risk. 听