asane

The FBI warns that hackers are submitting fake requests for police data to steal people’s private information

Online Niel November 12, 2024

FBI Issues Notice to Private Industry Regarding Emergency Data Requests
Hackers use stolen .gov email addresses to pose as authorities
FBI-recommended mitigation measures should be implemented

Cybercriminals are using stolen government email addresses to send fraudulent emergency data requests to US companies to steal customers’ personally identifiable information (PII), which could be used for nefarious purposes such as phishing and identity theftexperts warned.

This attack vector has grown in popularity since August 2023, justifying the issue of a Notice to Private Industry from the FBI.

The bureau has also published a list of mitigation measures that businesses will put in place to keep personal data secure and ensure that only genuine data requests are processed.

Fraudulent requests on the rise

Over the past year, the FBI has seen a significant increase in forum posts from cybercriminals regarding fraudulent data requests. The trend started with a user who claimed that for $100, he could teach people to use data requests to get information on any social media account. Shortly after, another user discovered that by using a “.gov” email address, he could impersonate authorities and obtain much more detailed information to use for phishing.

Fraudulent data requests have gradually become more advanced and threatening, with one user posting in December 2023 that they include the threat of harm or death to an individual if the data request is not processed and approved.

Shortly after this, in March 2024, another known cybercriminal submitted a Mutual Legal Assistance Treaty (MLAT) to PayPal. MLAT used details from a child trafficking investigation, including the case number and legal code to appear legitimate, however PayPal refused MLAT.

In August 2024, a cybercriminal listed for sale “high-quality .gov emails for espionage/social engineering/data extortion/Dada requests, etc.,” which could be used for fraudulent data access requests to obtain private information about customers, including names, email addresses, phone numbers and other personal information.

The FBI recommends that companies double-check the security posture of any third-party connections they interact with and their own systems, as well as external or remote connections.

Businesses should also be wary of urgent data requests that highlight the urgency of the requests and check all details in the request for inconsistencies or doctoring. The full list of mitigations can be found here Here.

Association-anemone

Association-anemone

The FBI warns that hackers are submitting fake requests for police data to steal people’s private information

Online Niel

The new era of personalized customer experience and privacy

Tundu Lissu: Stop using security agencies to brutalize Tanzanians

Beef smuggling racket busted, 5 arrested

Qatar suspends mediation efforts in Gaza

The FBI warns that hackers are submitting fake requests for police data to steal people’s private information

Online Niel

You Might Also Like

The new era of personalized customer experience and privacy

Tundu Lissu: Stop using security agencies to brutalize Tanzanians

Beef smuggling racket busted, 5 arrested

Qatar suspends mediation efforts in Gaza