US telecommunications company Cox Communications has disclosed a data breach that exposed some customers’ information, BleepingComputer reports. The company said in a breach notification letter that an attacker was able to gain access to some customer accounts after using social engineering tactics to impersonate a Cox employee.
“On October 11, 2021, Cox learned that an unknown person(s) had impersonated a Cox agent and gained access to a small number of customer accounts,” the statement said. “We immediately launched an internal investigation, took steps to secure the affected customer accounts, and notified law enforcement of the incident," reads the data breach notification signed from Amber Hall, Chief Compliance and Privacy Officer of Cox Communications. After further investigation, we discover that the unknown person(s) may have viewed certain types of information that are maintained in your Cox customer account, including your name, address, telephone number, Cox account number, Cox.net email address, username, PIN code, account security question and answer, and/or the types of services that you receive from Cox.”
Cox urges affected customers to keep an eye on their finances for any suspicious activity.
“We assure you that we take this incident very seriously,” the letter continued. “Out of an abundance of caution, we recommend that you review your financial account statements for fraudulent or irregular activity. You should immediately report any unauthorized activity to your financial institution. We also recommend that you change the password on any accounts that may use the same password as your Cox account.”
BleepingComputer offers the following additional recommendations for Cox customers:
- Immediately change the password and account security questions/answers on your Cox account.
- Be on the lookout for phishing emails pretending to be from Cox that are designed to steal your login credentials.
- Enable 2-factor authentication for your Cox accounts to make it harder for threat actors to log in to your account.
New-school security awareness training can enable your employees to follow security best practices so they can avoid falling for social engineering attacks. And sound policies based on best practices can help reduce the risk of being deceived by someone pretending to be an employee.
BleepingComputer has the story.
New-school Security Awareness Training is critical to enabling you and your IT staff to connect with users and help them make the right security decisions all of the time. This isn't a one and done deal, continuous training and simulated phishing are both needed to mobilize users as your last line of defense. Request your one-on-one demo of KnowBe4's security awareness training and simulated phishing platform and see how easy it can be!
