Vendor Email Compromise is Officially A Big (Seven-Figure) Problem

Vendor Email CompromiseWhile the Solarwinds “sunburst” attack brought to light the compromising of a vendor, VEC has been around for some time and now seems to be going mainstream.

I first mentioned Vendor Email Compromise (VEC) back in late 2019. This method of compromising an email account at one company purposely to use it to attack a second company has been quietly evolving over the last 14 months.

New data from Abnormal Security’s report, The Rising Threat of Vendor Email Compromise in a Post-SolarWinds Era sheds light on just how prevalent this attack method is becoming. According to the report:

  • Your chance of getting hit with a VEC attack during any given week increased 82% between Q3 of last year and January of this year
  • The average cost of a VEC attack is $183K with the largest observed being $1.6М
  • Billing account update fraud is the most expensive (on average) at $300K

Vendor email compromise is one of the most dangerous methods of attack because it uses a legitimate email account from a known vendor and (potentially) known person within that company! Users involved with financial transactions need to undergo Security Awareness Training to understand the common scams (e.g. updating banking details on payments) and how to avoid being a victim (by calling the person via phone back at a known-good number to verify the change). Otherwise, VEC looks like it’s going to get costly.

Request a Demo of KCM GRC

The new KCM GRC platform helps you get your audits done in half the time, is easy to use, and is surprisingly affordable. No more: "UGH, is it that time again!" 

products-KCM2-2With KCM GRC you can:

  • Reduce the amount of time and money required to easily manage your compliance, risk, and audit requirements
  • Automate reminders so you can quickly see what tasks have been completed, not met, and are past due
  • Simplify risk management with an intuitive interface simple workflow based on NIST 800-30.
  • Efficiently manage your third-party vendor risk requirements
  • Quickly implement compliance and risk assessment processes using KnowBe4's pre-built requirements and assessment templates

Request Your Demo

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews