South African entertainment agency Goliath and Goliath is the latest victim of a malicious cyberattack. The hackers reportedly stole about R 300,000 through an email scam, as well as stealing an additional R 20,000 from the agency’s subsidiary, PR Bailiff.
According to a statement from one of the officials, the hackers intercepted emails from the agency, altered banking information and subsequently forwarded these emails to clients.
These clients finally then paid amounts for the invoices they received ranging from R 60,000 to 130,000 into the accounts of the hackers.
The CEO of Goliath and Goliath, Kate Goliath, identified that she learned about the incident after one of their clients alerted them of a change in the bank details on an invoice he had received.
Goliath also confirmed that the hackers had harassed their customers for payments soon after sending the fraudulent emails. She further confirmed that the hacking happened some few weeks back.
According to Goliath, the agency’s service provider informed them that it was a phishing attack and therefore not their doing. However, she believes that there is more to the story.
She indicated that the agency has already begun more investigations are setting up meetings with clients who have come forward with claims of being duped.
How Goliath and Goliath Lost R 300,000
One industry expert—whose identity remains anonymous—opened up to the media about how the scam occurred to give some in-depth insight on its occurrence.
The expert informed that for the phishing scam to push through, it is highly likely that one of Goliath and Goliath’s employees was a victim of the fraud, allowing the criminals to gain unauthorized access to the agency’s mailbox.
This scam, also dubbed the “change of bank account” con, prompts business partners of the attacked agency to pay money into bank accounts listed to the scammers.
These scams occur by tracking invoices the victim firm sent to their clients and then issuing altered invoices with amended banking details.
Later, scammers delete the amended emails they sent to erase any incriminating evidence which may reveal their activities.
Media and Entertainment Hot Spots for Cybercriminals
Referencing to the 2018 Allianz Risk Barometer, there is a noticeable trend, especially in the banking sector.
Some financial institutions are continually posting warnings before a customer makes a payment, asking them to verify whether the bank details are accurate.
This, according to the report, is perhaps due to the surge in phishing attacks in recent times.
The 2018 Barometer outlines that cyberattacks are more prevalent in the media and entertainment, telecommunications and technology, and financial services industries.
In particular, the reports indicate that cybercrime remains a significant threat courtesy of responses from South African businesses, 38 percent of which have reportedly lost billions of Rands annually to cyberattacks.
According to Craig Rosewarne, managing director of Wolfpack Information Risk—a threat intelligence company whose specialty lies in understanding and predicting cyber threats—both medium and small businesses are as vulnerable to hacking as large businesses.
Rosewarne further stated that the small businesses, however, fall victim more often because, for them, security is usually the last contemplation until they are attacked or end up leaking sensitive client information or lose a significant amount of money.
Security Tips for Businesses
In his statement, Rosewarne advised that firms under such attacks should perform an independent risk assessment and subsequently get guidance on the ways they can use to mitigate risk.
The companies should inform their staff about the risks and back this up with an accompanying information security policy which contractors and staff consequently sign.
Rosewarne also insisted on the significance of a company having an up-to-date anti-malware software installed on all devices in their systems that process sensitive information.
He also noted with concern that cybercrime is fast turning out to be the primary risk many nations, governments and organizations are currently facing.
Nonetheless, he mentions that in all these cases, it usually comes down just one individual in the system who first gets compromised.
As such, there is a great need for organizations to promote cybersecurity awareness, both for the good of the business and for employees’ personal lives.