Cyber Insights with Mercury IT- June 2023

Welcome to the latest issue of Cyber Insights! In this edition we discuss the latest Paypal scam, unpack the most recent security breaches and share some tips on email security.

Current Scams

Cybercriminals have recently utilised PayPal, the popular international online payment platform. Cybercriminals are impersonating PayPal to steal your personal or financial information.

In this scam, cybercriminals send you a phishing email claiming that one of your PayPal payments failed and that you must act quickly. The email includes a phone number that appears to be from PayPal, prompting you to call. This phone call seems legitimate, but it is the work of cybercriminals impersonating PayPal. If you call this number, cybercriminals can trick you into giving away your personal or financial information.

To avoid similar scams, follow the advice below:

Be cautious when providing financial information over the phone. Instead, go to the organisation’s official website rather than using phone numbers provided in emails.
Be wary of emails that convey a sense of urgency. Cybercriminals use a sense of urgency to catch you off guard and cause you to click or act rashly.
Keep in mind that this type of attack is not limited to PayPal. Cybercriminals could use this technique to impersonate any organisation in any country.

Latest Security Breaches

Exploit: Ransomware

Crown Princess Mary Cancer Centre: Specialty Medical Clinic

Risk to Business : MODERATE

Crown Princess Mary Cancer Centre in Westmead Hospital has disclosed that it has been the victim of a ransomware attack by the cybercrime group Medusa that has led to patient data exposure. The group claims to have grabbed thousands of files, some containing sensitive patient data. It is threatening to expose them if they do not pay $100,000. The clinic has not confirmed what amount or types of data were stolen. NSW Health is investigating the incident in concert with authorities.

Cybersecurity Tips

The prevalence of phishing scams is at an all-time high. With you being the key to preventing a cyber-attack within your organisation, it is essential to question the legitimacy of every email you receive. Below is a list of questions to ask yourself about the email’s date, time and subject that may help you realise that you are being phished.

DATE: Analyse the timing of the email.

Did you receive an email you usually get during regular business hours, but it was sent at an unusual time, such as 3 a.m.?

SUBJECT: Review the subject line.

Does the subject line make sense, given the context of the email?

Is the email message a reply to something you never sent or requested?

If you notice anything about the email that alarms you, do not click links, open attachments, or reply. You are the last line of defence to prevent cyber criminals from succeeding and making you or your organisation susceptible to phishing attacks.

Find out more about cybersecurity for your business here or book a complimentary consultation with our Chief Information Security Officer, Chris Haigh here