Email from a genuine account is not always safe
An email from someone you know is not necessarily safe. When an email account is compromised, established relationships can become a route through which harm spreads. Drawing on reports of malicious emails sent under an employee’s identity, this article explains the basics that users and administrators should check.
Consider the reports about Nikkei’s incident
Reporting on an announcement made by Nikkei on 4 October, INTERNET Watch stated that an employee’s Microsoft 365 account had been attacked and that approximately 9,000 emails impersonating the employee were sent on 30 September [1]. The same report treated unauthorised access to Google Workspace and suspected leakage of personal information as a separate incident. Here, we focus on how impersonation emails can expose others to harm. We do not infer the account’s authentication settings or the precise method of compromise from this reporting.
The sender alone cannot establish whether a message is safe
When an organisation’s email account is compromised, recipients may receive messages from a contact’s genuine address. Training that focuses only on spelling errors or unnatural Japanese is therefore insufficient. It is important to check whether a request departs from normal procedures, such as an unexpected sign-in request, a change of payment details or an urgent demand for information. When verifying a request, we suggest using a previously known telephone number or another established communication channel, rather than relying solely on the reply address or number provided in the email.
Prepare both authentication and post-compromise response
Multi-factor authentication checks another factor, such as a device you possess, in addition to a password. CISA’s ransomware guide recommends phishing-resistant multi-factor authentication for services including email and VPNs [2]. Organisations should review not only its deployment, but also accounts exempted from it, administrator privileges and older connection methods. Procedures for a suspected compromise should include changing passwords, revoking existing sessions, checking suspicious forwarding settings and application access permissions, and warning recipients. The necessary actions vary by service, so administrators should validate the procedures in advance.
Build organisational response rather than blaming individuals
People need to be able to report concerns quickly, even after taking a suspicious action. Establish a contact point for situations such as entering credentials through a link or approving an authentication request they do not recognise. Administrators are responsible for investigation and containment after a report. Training should include practising verification through another channel when requests differ from normal procedures, as well as recognising suspicious language. Start by ensuring everyone can answer: who should I contact if someone I know sends a link asking me to authenticate?
Next to read
Where Should You Start with Cybersecurity? — A Learning Path for Beginners
Consider a learning route from the fundamentals towards practical work.
How AI Could Change Cybersecurity Learning — The AI Learning Cyber Hiroshima Is Working Towards
Discover the AI-assisted learning support Cyber Hiroshima is working towards.