Cybercriminals don't always need to break through a company's digital defenses. Sometimes, they just need to convince an employee that they belong there. It’s surprisingly simple sometimes and a recent incident at Apollo Global Management is one example.
Apollo Global Management is one of the world's largest investment firms. It recently disclosed that attackers gained unauthorized access to some of its cloud platforms between July 6 and July 10.
The attackers used good old-fashioned social engineering. That’s just a fancy term for manipulating people into doing something they shouldn’t or otherwise wouldn’t.
And the information potentially exposed is anything but trivial.
What Was Exposed?
According to Apollo's breach notification, the information may include:
- Names
- Dates of birth
- Contact information
- Home addresses
- Social Security numbers
Apollo has not said how many people were affected or specifically who those individuals are. IT also says there is currently no evidence that the information has been publicly posted or used for identity theft or fraud. But that doesn’t mean it hasn’t…or won’t be.
Social Security numbers combined with other personal information can be valuable to criminals looking for opportunities to commit identity theft or create convincing scams. This usefulness can last far into the future; years even.
The Human Being Was the Target
The attack is particularly interesting because it is part of a broader campaign targeting financial and professional-services companies. Google researchers have warned about attackers using phone calls and impersonation, including pretending to be IT support, to convince employees to provide credentials or authentication information.
In other words, the criminals aren't necessarily trying to defeat the company's security technology. They're trying to defeat the person using it. And that tactic isn't limited to billion-dollar investment firms.
It Could Happen to You
Imagine receiving a phone call from someone claiming to be from your bank.
They know your name and sound professional, and may even know more information about you. They tell you there is suspicious activity on your account and ask you to read them the security code that just arrived on your phone.
Stop...Right...There
Never give an unexpected caller a password, authentication code or other security information. If someone claims to be from your financial institution, payment-card company, or another organization you do business with, hang up and contact the company using a phone number you already know is legitimate.
The Apollo breach is a reminder that cybersecurity isn't just about firewalls, antivirus software and complicated computer defenses. Sometimes, it's about recognizing when someone is trying to manipulate you. The hackers didn't necessarily have to outsmart Apollo's technology. They had to convince a person to let them through.And that's a lesson worth remembering the next time someone unexpectedly calls saying, "I'm from IT."
SUBSCRIBE TO WEEKLY NEWSLETTER
