Keep PII Private and Avoid SpearPhishing

Without even realizing, hackers have access to a lot of personal information about us. We post a lot to social media sites and some of us even go to considerable effort to make sure the information we share is limited to people on our “friends” or “connections” list. Just keep in mind that more often these days, the personally identifiable information or PII is becoming more valuable than even our credit cards.

Case in point: Carphone Warehouse. It’s a U.K.-based company that was a recent data breach victim. It has over 2,400 stores across Europe. While the information obtained included encrypted payment card data of up to 90,000 customers, other information was also retrieved and potentially even more valuable to the hackers.

Up to 2.4 million customers may have had their names, address, birthdates, and bank account details also retrieved. Why is this significant? Targeted phishing attacks, or spear phishing, are becoming more common and is very difficult for all the automated threat protection to detect. This is because spear phishing uses PII to try and trick users out of more information such as login credentials. These could be for online banking accounts for personal or corporate accounts as well as login information to IT systems.

That is why it is very important to limit the personal information we make available to others, even if they are friends or connections. Once that information is shared by others, we lose control over who sees it or where it goes. So keep a few things in mind when posting to social media or providing information to strangers or those you do not know well.

• It is OK to list a job title or where you work on sites such as LinkedIn or Xing, but use caution when describing functions of your job. Criminals can use the fact that someone performs corporate wire transfers to their advantage, for example.

• Never post PII online including social security numbers, credit card details, birth dates, addresses, or perhaps even information about your kids or pets. All of this may be used against you for phishing or scams, even on dating sites. Make sure you trust people before discussing personal details.

• Pay attention to email messages from known or unknown senders that include links or attachments and don’t click or open them unless they are expected or there is no doubt what-so-ever about their authenticity.

• If your online financial accounts offer two-factor authentication, take advantage of it. This usually means that a key fob of some sort will be provided that randomly generates codes to be typed in each time the account is accessed. More often these days, a passcode is sent via text that must be entered in order to get authenticated.

• If you perform wire transactions for your company or have access to corporate accounts, make sure you follow the corporate policy regarding financial transactions. This should include confirming wire transfer authorizations and abiding to separate of duties.

The Carphone Warehouse attack joins an ever-increasing list of retail data breaches including Home Depot, Sally Beauty, and Staples. Cyber-attacks such as these are increasingly becoming a concern for retailers and their vendors and now it’s not only about the payment card information; it’s also about that private information. So, do what you can to protect yours for yourself and for your company.