Snapchat’s pictures are deleted automatically seconds after they’re viewed. Unfortunately, the same isn’t true of the company’s confidential financial records, which it just handed over to a scammer.
In a blogpost, the company apologised to its staffers after a phishing attack tricked an HR employee into handing over payroll information about “some current and former employees”.
The blogpost continues: “Needless to say, we responded swiftly and aggressively. Within four hours of this incident, we confirmed that the phishing attack was an isolated incident and reported it to the FBI. We began sorting through which employees – current and past – may have been affected. And we have since contacted the affected employees and have offered them two years of free identity-theft insurance and monitoring.”
None of Snapchat’s user data was given to the scammer. The only affected parties are the employees, both current and former, whose information was handed over.
It seems Snapchat fell prey to an embarrassingly common type of phishing email, which purports to come from the head of the company itself. In this case, an email supposedly from chief executive Evan Spiegel was sent to the HR staffer, who responded with the information requested. It’s easy to see why: who wants to keep the chief executive waiting when they ask for information?
Still, Snapchat was lucky in the grand scheme of things. Similar scams have netted far more than a small amount of payroll information: one company, Ubiquiti Networks, sent a payment of $46.7m (£33.6m) in June after an email supposedly sent by its CEO, while the Financial Times reports that a total of $2bn has been lost to similar scams in the past two-and-a-half years.
Jonathan Sander, the VP of Product Strategy at security software providers Lieberman Software, said: “The fact that Snapchat got snagged with this shows that being young, cool, and high-tech doesn’t protect you from being a phishing target.
“Bad guys are getting so good at phishing that they aren’t just fooling that older relative who calls a grandchild every time they need to print something. Even people born into the internet, apps and the cloud are clicking on bad links. That’s very good news for attackers, in case they were worried that millennials would put them out of the phishing business with their tech savvyness.”
Maybe the solution is running the company through Snapchat itself? It might get a bit annoying never being able to refer back to previous emails, but at least data that self-destructs is rather harder to leak.
This article was written by Alex Hern, for theguardian.com on Monday 29th February 2016 15.48 Europe/Londonguardian.co.uk © Guardian News and Media Limited 2010