American Airlines has disclosed that an attacker used phishing attacks to breach the company’s systems, BleepingComputer reports.
“On July 5, 2022, American identified unauthorized activity in its Microsoft 365 environment after individuals reported receiving phishing emails from an American employee's account,” the company said in a legal filing. “Further investigation by American's Cyber Security Response Team (‘CIRT) revealed certain accounts may have been accessed by an unauthorized actor who used the accounts to send phishing emails. The unauthorized actor may have also previewed certain files on an employee sharepoint site.”
The threat actor continued to send phishing emails to other employees from each compromised account.
“Through its investigation, American was able to determine that the unauthorized actor used an IMAP protocol to access the mailboxes,” the statement says. “Use of this protocol may have enabled the unauthorized actor to sync the contents of the mailboxes to another device. American has no reason to believe that syncing the contents of the mailboxes was the purpose of the access. Based on the fact, it appears the unauthorized actor was using IMAP protocol as a means to access the mailboxes and send phishing emails.”
The attacker gained access to personal information, but American thinks it would be too time-consuming for the attacker to harvest much of the data.
“Notwithstanding, following the forensic investigation, American conducted an extensive eDiscovery exercise to determine whether any personal information was contained in the mailboxes,” the company says. “The review identified personal information in the mailboxes on or around August 16, 2022. The information in the mailboxes may have included name, Social Security number, employee number, date of birth, mailing address, phone number, email address, driver’s license number, and/or passport number.”
New-school security awareness training can teach your employees to recognize phishing and other social engineering attacks.
BleepingComputer has the story.
Here's how it works:
