We’ve likely all encountered, and successfully identified, a suspicious link. They might be long
with numerous special characters; they may be deceptively similar to an authentic site; and they
probably come attached to a message that offers lucky users a refund or cash prize if they
follow through.

But scams aren’t always that obvious. We recently handled a cyber incident for a client that
illustrates the risks associated with clicking links in emails – even those that appear legitimate.

The trigger: A seemingly harmless link

The attack began with a sophisticated phishing email, carefully crafted to appear as a genuine
communication from another business. An employee, believing the email to be legitimate,
clicked on a link contained within it. This seemingly innocuous action triggered a series of events
with significant consequences.

The chain reaction: From click to compromise

When the employee clicked the link, it installed a hidden program on their computer. This
program gave the attackers a way into the company’s entire computer system. Once inside, they
were able to gain more control and eventually take over an employee’s email account, which
was connected to other parts of the system.

From this compromised mailbox, phishing emails were sent to almost 2,000 contacts, both
internal and external. This secondary wave of phishing emails further amplified the potential
damage.

The impact: A ripple effect of consequences
The client experienced several immediate and significant consequences:
Network intrusion: Unauthorised access to their network and systems.
Data compromise: Potential exposure of sensitive data.
Phishing propagation: The spreading of malicious emails to a large number of contacts.
Operational disruption: The need to investigate and contain the breach caused
significant disruption to business operations.
Legal and regulatory obligations: Notifying affected parties and complying with
regulatory requirements, including the ICO.

The response: Expert intervention and mitigation
Our client acted quickly, and spoke to their insurers, whose response was swift:
Risks controlled: IT forensics experts investigated the breach, secured the systems,
and determined the extent of the compromise.
RPC: Legal experts assisted with regulatory compliance, including notification to the ICO,
and reviewed contractual obligations related to client notifications.
Waived excess: The £1,000 excess on the client’s policy was waived due to the client
notifying the insurance company within 72 hours.

The cost: Minimised by early interventionThe swift and decisive response from our insured and their insurers played a crucial role in minimising the damage. Had there been any delay in engaging the forensic IT experts and legal team, the consequences could have been far more severe.

The rapid isolation and securing of the insured’s network prevented further data breaches and
limited operational disruption. This proactive approach not only contained the immediate threat, but also significantly reduced the potential for long-term financial and reputational damage.

While the claim settled for just under £60,000, without this immediate action, the costs
associated with data recovery, legal fees, regulatory fines, and business interruption could have
escalated into hundreds of thousands of pounds – potentially jeopardising the entire business.

Lessons learned: Preventing future incidents
This incident highlights the following crucial lessons:

1. Phishing can be sophisticated: Phishing emails are becoming increasingly
sophisticated, making it difficult to distinguish between legitimate and malicious
communications.

2. Employee training is vital: Regular cybersecurity training is essential to educate
employees about the dangers of phishing and how to identify suspicious emails.

3. Security measures are non-negotiable: Implementing strong security measures, such
as multi-factor authentication and endpoint protection, can help prevent malware
infections.

4. Rapid response minimises damage: Quick notification of a breach is critical to
minimise the damage.

5. Synchronised mailboxes can pose a risk: Be aware of the implications of
synchronised mailboxes, as a compromise of one, leads to greater issues.

Protect your business with Riskbox

What started as a single click led to significant reputational damage, halted business operations,
and landed our client with a £60,000 hit. But with the right protection, this doesn’t have to be
you.
By prioritising cybersecurity awareness and implementing robust security measures, businesses
can significantly reduce their risk of falling victim to phishing attacks. Get in touch with RiskBox
today to check you’re covered should the worst happen.

Photo by Ed Hardie on Unsplash