This week, Framework Computer revealed a data breach that exposed the personal information of undisclosed customers. The breach transpired after Keating Consulting Group, their accounting service provider, fell victim to a phishing attack.

The California-based manufacturer revealed that an accountant at Keating Consulting Group was tricked by a threat actor impersonating Framework's CEO into sharing a spreadsheet containing customers' personally identifiable information (PII) associated with outstanding balances for Framework purchases.

The attack took place on January 11th, when the threat actor sent an email to the accountant impersonating Framework's CEO, requesting Accounts Receivable information. Subsequently, on the same day, the accountant responded to the attacker, providing a spreadsheet containing the following information: Full Name, Email Address, and Balance Owed. Notably, this list primarily comprised a subset of open pre-orders, but also included some completed past orders with pending accounting syncs.

Following an investigation, Framework identified all customers whose information was exposed and promptly notified them via email.

Securing Your Small Business In 3 Essential Steps

1. Employee Training - Conduct regular mandatory phishing and social engineering attack training for all employees with access to sensitive customer information. A well-informed team can serve as the first line of defense against such breaches.

2. Auditing Procedures - Implement strict reviews of standard operating procedures around information requests. Audit the trainings and standard operating procedures of all other accounting and finance consultants who have had or currently have access to customer information.

3. Customer Communication - Regularly communicate with customers about potential risks and educate them on identifying and reporting suspicious activities. Encourage customers to reach out directly to the support team regarding any unusual emails or requests for sensitive information.

To further support businesses, Triad Cyber Solutions offers a Free External Scan to help identify potential vulnerabilities.

For personalized assistance in reinforcing your business's security measures, you can book a Discovery Call with us.