Phishing attacks are becoming more common with larger companies as well as small. Recently, big companies like eBay, HMRC and Apple have all been targets of phishing attacks. It can feel unnerving because you are forced to feel untrustworthy towards whatever email you receive in the future. However, when your company is the victim of the attack, it can feel like a different story. Here are some tips for how to respond when your company has fallen victim to phishing:
Stay calm and gather the facts
When you first hear about a phishing attack, you may want to panic. It feels like you need to act quickly, and you do – but you need to be calm and concise about it. So first, gather the facts. What do you know at this stage? What are the signs you have been hacked? Is data currently secure? Is the leak ongoing? You should also figure out what kind of phishing attack you believe it to be at this stage. Wired.co.uk says there are several types of attacks;
- Deceptive phishing – involves being targeted with a fake link
- Spear phishing – often involves the creation of an email address that looks genuine and is in the name of a colleague. A message will then be sent to the target and appear to be real.
- CEO phishing – involves impersonating a CEO or a person of power to ensure payments are made.
- Changing an IP address of a website – The DNS servers of a website are targeted and will redirect users of that site to a fake page.
- Google Document phishing – where fake pages are sent to contacts disguised as real files.
Have a meeting with the other managers in your company to gather this information and form your next important steps.
Lockdown
Sometimes while you gather all the facts, it is a good idea to lockdown your systems until you figure out where the breach came from. Don’t be afraid to keep this down until you’re ready.
Communicate with staff
Your staff need to know what has happened – so keep in contact with them. If emails are on lockdown, hold a meeting first thing in the morning or call them if you need to. Once they know about the attack, they could share more light on why it happened or help to stop it happening again.
Communicate with customers
Your customers may be at the forefront of this attack. It is wise to have a damage control system in place should a phishing attack happen, so that you can instantly follow steps without getting in a panic. Wonga ZA did this quite well when they responded to a phishing attack. They set up a fraud hotline, so worried customers could get information about what had happened directly. The use of such a ‘hotline’ is a great idea in this instance and could be replicated elsewhere. Communication really is key!
Check your insurance
Some business insurance covers you if you are a victim to phishing attacks. Look into your insurance to see what you could claim.
Prevent it from happening again
You can learn new things from your mistakes, so make the necessary changes to ensure that a similar attack couldn’t strike twice. Perhaps you did nothing wrong at all – and this was simply a case of bad luck. If that’s right, accept it, try and repair the damage and then look into getting tighter systems in place or investing in insurance to help your business out in the future.
