Featured Article: Surge in Phishing Scams Targeting Our Community

As the Cybersecurity Committee Chair, I am compelled to address a critical issue that has recently come to our attention—a significant rise in phishing attempts specifically aimed at our membership and, by extension, the wider ship repair industry. These are not your common cyberattacks; we're seeing a sophisticated and interconnected campaign that directly targets our association.

 

The Nature of the Threat

Attackers are impersonating legitimate employees from known companies, utilizing fake email addresses. Their typical narrative involves "undergoing an accounting system change" within their company, accompanied by requests for detailed information on invoices and billing records. At a time when banking stability is a concern for many, such assertions could seem plausible to the unsuspecting eye.

These emails may initially appear legitimate and reasonable. They might even accurately reference specific contract and invoice numbers. Here's an excerpt of what some of our members have encountered:

"I hope this email finds you well.

I am reaching out regarding the payment processing of your open invoices billed to us under our contract [REDACTED]. We are currently undergoing a Company-wide Accounting System overhaul and adopting a new payment system, which will be applied to all our Supplier's invoices.

Therefore, we kindly request that you forward this email to the appropriate individuals in your billing department to resend all open invoices, ensuring these updates are applied for payment processing.

To avoid any payment issues or delays, please provide copies of all open invoices billed to date via this email as soon as possible.

Regards,"

 

Your Vigilance is Key

We urge you to instruct your employees to be vigilant for spoofed email addresses and web domains, as well as any unusual requests from external parties. The success of an attack on one business could have negative repercussions across a wide range of stakeholders. These spoofed email addresses can be difficult to spot, sometimes altering just one letter in an address (e.g., substituting the letter 'o' for a '0' (zero)), making them easily overlooked. If the attackers have knowledge of your employees, they may also use social media to personalize their approach with details like, "Hi [Name], I saw you just returned from Cabo…" or "Hi [Name], I saw your son was just accepted at Virginia Tech…" Such personal touches can lower the recipient's guard.

 

Thank You

Thank you to the member companies that have brought this issue to our attention. Your vigilance helps protect our community from these malicious activities.

 

ABOUT THE AUTHOR:

As CEO of G2 Ops, Inc., Tracy Gregorio leads a group of experts in Model-Based Systems Engineering (MBSE), Cybersecurity, and Cloud Engineering that provides a well-rounded portfolio of skill, knowledge, and adaptability to solve real-world business challenges. Tracy leads by example and draws on 35 years of business experience as well as education from Old Dominion University and Virginia Tech, and business and technology certifications from Goldman Sachs and MIT. A proud Virginian, she stays active in the community and serves on several boards and committees ranging from the Virginia Maritime Association Board to the Virginia Modeling and Simulation Advisory Council.

« Return to Newsletter