Business Email Compromise (BEC) attacks Attack.Phishing jumped 45 % in the final quarter of 2016 , compared to the previous three months , according to new stats from Proofpoint . The security vendor claimed such attacks have grown both in volume and sophistication . Also known as “ CEO fraud ” and “ whaling ” , these attacks Attack.Phishing typically involve fraudsters spoofing Attack.Phishing the email addresses of company CEOs to trick Attack.Phishing staff members into transferring funds outside the company . However , Proofpoint also includes attempts to target HR teams for confidential tax information and sensitive employee data , as well as engineering departments which may have access to a wealth of lucrative corporate IP . In its analysis of over 5000 global enterprise customers , it claimed that in two-thirds of cases the attacker spoofed Attack.Phishing the “ from ” email domain to display the same as that of the targeted company . These attacks Attack.Phishing can thwart some systems , because they don ’ t feature malware as such – just a combination of this domain spoofing Attack.Phishing and social engineering of the victim to force them to pay up . Part of the trick is to harry the target , rushing them so they have less time to think about what they ’ re doing . That ’ s why over 70 % of the most common BEC Attack.Phishing subject line families appraised by Proofpoint featured the words “ Urgent ” , “ Payment ” and “ Request ” . The vendor claimed that firms in the manufacturing , retail and technology sectors are especially at risk , as cyber-criminals repeatedly look to take advantage of more complex supply chains and SaaS infrastructures . Vice-president of products , Robert Holmes , argued that although employee education was important , it needs to be complemented by the right set of tools to weed out fraudulent emails . “ When it comes to BEC attacks Attack.Phishing , employees should never be an organization ’ s first line of defense . It is the organization ’ s responsibility to ensure that security technologies are in place , so that BEC attacks are stopped before they can reach their intended target , ” he told Infosecurity Magazine . BEC Attack.Phishing has become so popular among the black hats that the FBI warned organizations last year the scams had cost billions since 2013 . Trend Micro predicted that 2017 would see more and more cyber-criminals turn to BEC Attack.Phishing given the potential rich pickings – claiming the average pay-out is $ 140,000 , versus just $ 722 for a typical ransomware attack Attack.Ransom . However , Holmes argued that ransomware and BEC actors are likely “ two distinct types of criminal ” . “ While ransomware attacks Attack.Ransom require technical infrastructure to launch campaigns at scale , BEC attacks Attack.Phishing are socially engineered and highly targeted in nature , conducted by a single actor rather than teams , and generally launched from shared email platforms , ” he explained . “ While cyber-criminals will always go where the money is , we do not envision a drastic change in tactics such as traditional purveyors of ransomware transitioning to BEC Attack.Phishing . As long as ransomware and trojans continue to pay , cyber-criminals with technical skillsets are unlikely to down tools and pivot towards such a fundamentally different type of attack vector . ”

Business Email Compromise (BEC) attacks Attack.Phishing jumped 45 % in the final quarter of 2016 , compared to the previous three months , according to new stats from Proofpoint . The security vendor claimed such attacks have grown both in volume and sophistication . Also known as “ CEO fraud ” and “ whaling ” , these attacks Attack.Phishing typically involve fraudsters spoofing Attack.Phishing the email addresses of company CEOs to trick Attack.Phishing staff members into transferring funds outside the company . However , Proofpoint also includes attempts to target HR teams for confidential tax information and sensitive employee data , as well as engineering departments which may have access to a wealth of lucrative corporate IP . In its analysis of over 5000 global enterprise customers , it claimed that in two-thirds of cases the attacker spoofed Attack.Phishing the “ from ” email domain to display the same as that of the targeted company . These attacks Attack.Phishing can thwart some systems , because they don ’ t feature malware as such – just a combination of this domain spoofing Attack.Phishing and social engineering of the victim to force them to pay up . Part of the trick is to harry the target , rushing them so they have less time to think about what they ’ re doing . That ’ s why over 70 % of the most common BEC Attack.Phishing subject line families appraised by Proofpoint featured the words “ Urgent ” , “ Payment ” and “ Request ” . The vendor claimed that firms in the manufacturing , retail and technology sectors are especially at risk , as cyber-criminals repeatedly look to take advantage of more complex supply chains and SaaS infrastructures . Vice-president of products , Robert Holmes , argued that although employee education was important , it needs to be complemented by the right set of tools to weed out fraudulent emails . “ When it comes to BEC attacks Attack.Phishing , employees should never be an organization ’ s first line of defense . It is the organization ’ s responsibility to ensure that security technologies are in place , so that BEC attacks are stopped before they can reach their intended target , ” he told Infosecurity Magazine . BEC Attack.Phishing has become so popular among the black hats that the FBI warned organizations last year the scams had cost billions since 2013 . Trend Micro predicted that 2017 would see more and more cyber-criminals turn to BEC Attack.Phishing given the potential rich pickings – claiming the average pay-out is $ 140,000 , versus just $ 722 for a typical ransomware attack Attack.Ransom . However , Holmes argued that ransomware and BEC actors are likely “ two distinct types of criminal ” . “ While ransomware attacks Attack.Ransom require technical infrastructure to launch campaigns at scale , BEC attacks Attack.Phishing are socially engineered and highly targeted in nature , conducted by a single actor rather than teams , and generally launched from shared email platforms , ” he explained . “ While cyber-criminals will always go where the money is , we do not envision a drastic change in tactics such as traditional purveyors of ransomware transitioning to BEC Attack.Phishing . As long as ransomware and trojans continue to pay , cyber-criminals with technical skillsets are unlikely to down tools and pivot towards such a fundamentally different type of attack vector . ”

Last week , the Internal Revenue Service ( IRS ) issued a new warning to employers , urging them to stay alert as reports of compromised W-2 records started to climb . This newest advisory aligns with the agency 's plan to delay refunds for those filing their returns early in order to combat identity theft and fraud . The IRS also informed employers the W-2 scam has moved beyond corporations , expanding to include schools , tribal organizations , and nonprofits . In a statement , IRS Commissioner , John Koskinen , said the scams - sometimes known as Business Email Compromise (BEC) attacks Attack.Phishing - are some of the most dangerous email scams the agency has seen in a long time . [ Learn about top security certifications : Who they 're for , what they cost , and which you need . `` It can result in the large-scale theft of sensitive data Attack.Databreach that criminals can use to commit various crimes , including filing fraudulent tax returns . We need everyone ’ s help to turn the tide against this scheme , '' Koskinen said . In 2016 , at least 145 organizations fell victim to BEC scams Attack.Phishing , exposing tens of thousands of employees to tax fraud and identity theft . Salted Hash kept track of some of the high-profile cases , and Databreaches.net tracked everything , resulting in a massive list of documented successful attacks . As of February 5 , 23 organizations have disclosed BEC-related data breaches Attack.Databreach publicly , each one resulting in compromised W-2 data . The confirmed BEC victims include ten school systems , a software development firm , a utility company in Pennsylvania , at least one restaurant in Indianapolis , and businesses operating within the healthcare , finance , manufacturing , and energy sectors . Distribution International emailed employees that their W-2 data was compromised Attack.Databreach on January 27 . Their notification expands the number of affected taxpayers to more than 30,000 . The scammers spoofed Attack.Phishing an email and pretended to be Attack.Phishing one of the company 's owners . W-2 records for all companies and all employees were compromised Attack.Databreach . Salted Hash reached out to Sky Climber 's CFO , Jeff Caswell , for more information . Also , the College of Southern Idaho has reported an incident that could impact 3,000 employees . According to Public Information Officer Doug Maughan , the W-2 records affected belong to seasonal and auxiliary staff . Palomar College disclosed an attack Attack.Databreach on January 30 , which affected employee W-2 records . The school did n't say the incident Attack.Databreach was the result of a BEC attack Attack.Phishing , but Salted Hash is listing it anyway due to the timing of the attack and the information targeted . Finally today , the West Michigan Whitecaps - a Class A minor league baseball team affiliated with the Detroit Tigers - said staff W-2 records were compromised after someone posing as Attack.Phishing a manager requested them . In 2016 , the criminals behind the BEC attacks Attack.Phishing mostly focused on payroll and tax records . This year though , the IRS says that in addition to the usual records request , the scammers are now following-up and requesting wire transfers . `` Although not tax related , the wire transfer scam is being coupled with the W-2 scam email , and some companies have lost both employees ’ W-2s and thousands of dollars due to wire transfers , '' the IRS explained in their warning . `` Employers should consider creating an internal policy , if one is lacking , on the distribution of employee W-2 information and conducting wire transfers . '' BEC attacks Attack.Phishing are essentially Phishing scams Attack.Phishing , or Spear Phishing Attack.Phishing since the criminals have a specific target . They 're effective too , exploiting the trust relationships that exist within the corporate environment . In a majority of the reported cases from 2016 , the attackers forged Attack.Phishing an email and pretended to be Attack.Phishing the victim organization 's top executive , or someone with direct authority . Often it is the CEO or CFO , but any high-level manager will work .