The Dallas-based payroll firm BenefitMall announced on January 4 that nearly 112,000 customers may have had their personal information exposed during a four-month long data breach.
The breach was discovered on October 11, when the company realized that several internal email accounts had been compromised by phishing attacks. The company brought in a third-party forensics team, which found that the initial compromise occurred in June 2018. The attacker gained access to additional accounts in the months that followed.
In a press release, BenefitMall stated that the “emails in the affected mailboxes may have included consumers' names, addresses, Social Security numbers, dates of birth, bank account numbers, and information relating to payment of insurance premiums.” The company didn’t explain why it took so long to notify customers after the breach was discovered, but says it’s working with law enforcement to investigate the incident.
BenefitMall stated that it’s put new security measures in place, such as two-factor authentication, to protect its email accounts from future attacks. The company is also committing itself to ongoing education and training programs to help its employees recognize phishing emails.
While these are steps in the right direction, organizations should implement these measures before they experience a data breach. New-school security awareness training can help your employees identify and report phishing attempts when they occur. HealthITSecurity has the story:
https://healthitsecurity.com/news/4-month-breach-of-benefitmall-impacts-112000-plan-members
Free Phishing Security Test
Find out what percentage of your employees are Phish-prone™
Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here's how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:
