Ireland’s Teaching Council has been fined €60,000 by the country’s Data Protection Commission (DPC) over a breach of nearly ten thousand teachers’ data, the Irish Examiner reports. An attacker gained access to two employees’ Gmail accounts by sending credential-harvesting phishing emails, then set up auto-forwarding rules to forward incoming emails to the attacker’s email address.
“[A]s part of the successful phishing campaign on two email accounts of Council staff, over 323 emails were forwarded to an external Gmail account, by a malicious actor,” the DPC said “One of the emails identified as being forwarded to the Gmail account was a spreadsheet containing the vetting status details of almost 10,000 teachers. The Council was asked to provide information on this spreadsheet, including details as to whom and from whom this spreadsheet was being sent and for what purpose.”
Notably, the two victims have denied entering their passwords on a phishing site, which the DPC says is probably because the victims don’t know when the attack happened.
“This would be expected as they would have perceived this to be normal activity and an advanced phishing campaign would capture details without the user being aware,” the DPC says.
The breached data included teachers’ names, addresses, Personal Public Service (PPS) numbers, and vetting clearance status. The DPC notes that the Teaching Council didn’t discover the breach immediately because they found no malware on their systems.
“The commission noted that the Teaching Council had been made aware via an alert that a forwarding rule had been created within its staff email servers,” the Examiner says. “However, the council ‘did not discover at that time’ that the breach had occurred due to ‘no evidence of malware’ being noted. Four alerts were sent to the council’s IT section before the problem was recognised.”
New-school security awareness training can give your organization an essential layer of defense by teaching your employees how to recognize phishing attacks.
The Irish Examiner has the story.
Here's how it works:
