December 2024 - CORSA-broadcast

How a simple misspelling cost an Ohio city $722,000 in a cyberheist
by Frank Hatfield Dec. 26, 2024

Dec. 26, 2024

I hope everyone is well this holiday season. Unfortunately, cyber criminals continue to remain busy throughout this time of year. Below is recent example of a payment redirection scam perpetrated on an Ohio city. Full article at the link below. Attached is a recent Ebroadcast with links to cyber loss control resources. We wish you all the best for the remainder of this holiday season and a Happy and Safe New Year. Stay safe. The electronic payment was routed to a bank account in Louisville, Kentucky, through a fraudulent email where "construction" in the domain name had a slight misspelling, with the second "c" and "u" swapped, and the username matched that of an employee whose name can be found on the firm's LinkedIn page. Using this email, the City authorized a $721,976.26 payment. How a simple misspelling cost an Ohio city $722,000 in a cyberheist | NBC4 WCMH-TV<https://www.nbc4i.com/news/local-news/athens/how-a-simple-misspelling-cost-…> Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Ohio Auditor of State - How to Protect Your Organization from Spear Phishing and Payment Redirect Scams
by Jim Hale Dec. 13, 2024

Dec. 13, 2024

In recent years, Ohio's local governments, school districts, and other public entities have increasingly been targeted by cybercriminals employing payment redirect and other business email compromise (BEC) schemes. These scams, often involving spear phishing, have led to significant losses of taxpayer dollars. Drawing on recent cases involving various public entities, it's essential for government officials to understand these attacks and the principles of cybersecurity to mitigate risk. Understanding the Threat In payment re-direct and other BEC scams, cybercriminals impersonate trusted vendors, employees, or business partners to deceive organizations into transferring money to fraudulent accounts. They do this by manipulating email correspondence, often using subtle changes to email addresses that can easily go unnoticed. For instance, an email might change from "vendor(a)example.com" to "vend0r(a)example.com." These schemes are often sophisticated and tailored, with criminals mimicking legitimate communications. Earlier this year, a recreation district in Central Ohio fell victim to a spear phishing attack involving fraudulent payment instructions from an email account that looked almost identical (only a single letter was changed) to that of a trusted contractor who was working on a large project. The vendor's account information was changed, which resulted in $713,000 going to the scammer's account. It was only after the vendor contacted the recreation district about the missing payment that the crime was discovered. Similarly, a school district in Clermont County and a school district in Cuyahoga County lost $1.7 million and nearly $620,000 respectively because they didn't properly verify payment information change requests from fake email addresses that appeared to be from legitimate contractors. Preventing Scams While we recognize there is no perfect system to prevent 100% of scams, taking proactive steps can dramatically reduce the chance of a loss. Here are some key principles and recommended actions to reduce the risk: 1. Verify and Validate Requests Never make changes to a vendor or employee's banking information without in-person verification. Don't rely on information in the change request email. Always use contact information from validated sources, such as previous invoices or official directories. In 2023, a village in Huron County suffered financial losses when the fiscal officer made payments totaling $269,000 in response to fraudulent invoices. This incident could have been avoided by using an independently verified contact method to confirm the legitimacy of the change. 2. Require In-Person (or Independent) Confirmation Verify change requests in person. If this is not possible, use only independently verified contact information and ask specific questions that only the legitimate requester could answer. Employees should develop a heightened sense of scrutiny, especially when a request for a change in payment information arrives unexpectedly or is accompanied by a sense of urgency. In the case of a township in Ottawa County, a spoof email requesting a change to an employee's direct deposit information led to five payments totaling $3,500 being transferred to a fraudulent account. Likewise, a school district in Seneca County lost nearly $2,000 after processing a fraudulent request to change an employee's direct deposit information. Had there been a policy requiring in-person verification or secondary approval, these attacks could have been prevented. 3. Separate Duties and Use Dual Authorization Separate the functions of payment change initiation and payment approval. Implement internal, secondary approvals for all requests involving changes to payment instructions or contact details. This ensures that no single individual can unilaterally change critical payment information without oversight. An agency in Stark County experienced losses of nearly $29,000 because six deposits were redirected to an unauthorized account following changes made without proper independent verification. Requiring dual authorization could have provided a safeguard against this fraud. 4. Employee Training and Awareness Providing continual training and education to employees about policies, procedures, and recent phishing threats is critical. Employees are often the first line of defense against fraud schemes, and consistent awareness training helps them recognize potential threats. 5. Use Technology to Assist Use layers of authentication, such as financial institution tools like ACH positive pay or debit block programs. These tools can help prevent unauthorized transactions from occurring by flagging discrepancies before money leaves the account. 6. Develop a Proactive Security Culture Public entities should create an organization-wide culture of security. Employees should feel comfortable questioning suspicious emails or requests, and there should be clear policies for dealing with any anomalies. A township in Belmont County avoided falling victim to a spear phishing attack because of the strong internal controls they had in place. When the township received a suspicious email requesting changes to payment information, they identified inconsistencies and flagged the request as fraudulent, preventing any financial loss. This is a great example of how proper verification and adherence to policies can safeguard against cyber threats. Conclusion The financial losses resulting from spear phishing and BEC scams can be devastating for public entities, affecting services and eroding public trust. However, with proper training, verification procedures, and a security-conscious culture, many of these incidents are preventable. Here's what do if you suspect your organization has been compromised by a cybercrime: first report the payment thefts to your financial institution to try to stop the transfer. Then notify local law enforcement. Next, contact the Ohio Auditor of State<https://ohioauditor.gov/fraud/default.html#ReportFraud> and report it to federal agencies including the Federal Bureau of Investigation's Internet Crime Complaint Center (IC3). By following these guidelines, including requiring in-person verification, watching out for red flags in email correspondence, implementing dual authorization, and consistently training employees, your organization can protect itself from falling victim to these sophisticated scams. [Keith Faber] How to Protect Your Organization from Spear Phishing and Payment Redirect Scams Keith Faber Ohio Auditor of State For the full article go to: https://ohioauditor.my.canva.site/ohio-auditor-payment-redirect-scams Also see the attached Payments Security Checklist. James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets."

1 0

Business Email Compromise: The $43 Billion Scam
by Frank Hatfield Dec. 13, 2024

Dec. 13, 2024

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The scam is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds. The scam is not always associated with a transfer-of-funds request. One variation involves compromising legitimate business email accounts and requesting employees' Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets. Losses associated with BEC scams quadrupled last year to an astonishing $43 Billion according to the FBI statistics below. Just last week about $4 million in federal funding intended for housing assistance in Kentucky was stolen after someone directed that money to a private bank account. (Source: https://www.cnn.com/2022/08/29/politics/kentucky-4-million-cyber-theft/inde… ) "These types of attacks can be especially impactful to state and local governments that may do business with dozens, if not hundreds, or different vendors," Hassold, who is now director of threat intelligence at cybersecurity firm Abnormal Security, told CNN. FBI SUGGESTIONS FOR PROTECTION * Use secondary channels or two-factor authentication to verify requests for changes in account information. * Ensure the URL in emails is associated with the business/individual it claims to be from. * Be alert to hyperlinks that may contain misspellings of the actual domain name. * Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate. * Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from. * Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed. * Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits. Source: FBI Public Service Announcement https://www.ic3.gov/Media/Y2022/PSA220504 CORSA is committed to keeping members informed of and protected against threats to their financial assets and systems. BEC and/or payment fraud is on the rise which creates considerable exposure to governmental entities, including CORSA members. Current technology provides sophisticated criminals the tools to create or alter checks or divert payments via BEC or social engineering. In addition to the FBI's above recommendations, CORSA strongly encourages members to enroll in the anti-fraud services Positive Pay and ACH Positive Pay. The Ohio Auditor of State also recommended enrolling in the above anti-fraud services to guard against check fraud. (See: Auditor of State Best Practices https://ohioauditor.gov/publications/bestpractices/best%20practices%20sept%…) Positive Pay is a service that essentially requires bank customers to provide their bank with a list of checks that are to be paid, while payment is withheld for any checks that don't match the customer's list. The ACH Positive Pay service allows a customer to set parameters on payments. For instance, payments that occur regularly with similar amounts can be set up to pay automatically, while any payments that fall outside normal transactions will be suspended until authorized. Most banks offer Positive Pay and ACH Positive Pay for a fee. In CORSA's experience fees vary, but customers are able to significantly lower fees through negotiation. Should you have questions regarding Positive Pay or ACH Positive Pay contact Thisbe Butcher at tbutcher(a)ccao.org<mailto:tbutcher@ccao.org> [Chart depicting Reported Loss Associated with BEC/Cryptocurrency Complaints for the years of 2018, 2019, 2020, and 2021.] Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image002.png@01D8BD3E.0B6EC360] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 2

Cybercrimes Spike During the Holiday Season
by Frank Hatfield Dec. 11, 2024

Dec. 11, 2024

Cybercriminals work overtime on holidays and weekends. According to a recent report, ransomware attackers often strike when defenses are weakest—86% of study participants who experienced a ransomware attack were targeted on a weekend or holiday, when staffing is most likely to be reduced. Attached is the report. If you haven’t done so already done so put a plan to in place now to maintain maximum cybersecurity for your County and/or agencies. Below is a list of considerations with links to more information. As always, feel free t contact regarding CORSA loss control services and programs. We wish you a safe and secure holiday season. PREPARE FOR HOLIDAY CYBER ATTACKS: Attackers strike the most during holidays and weekends when companies are vulnerable and understaffed. ⚠️ Attacks are more common during non-business hours, mostly due to less staff available to protect the company. ⚠️ Large, profitable companies tend to be the main targets but small businesses with less protection are also a target. ⚠️The attacks that occur during non-business hours take longer to investigate and resolve, which may slow response and notification. Action Items Protect your organization with these practices: ✅ Review cyber incident response plans, resiliency plans, and communications plans. ✅ Reiterate cybersecurity user awareness and training program tips that include guidance on how to report incidents. ✅ Tune endpoint protection, regularly update, and enable real-time detection for antivirus software on all hosts. ✅ Make (and test restore) an offline backup of your data. ✅ Confirm multi-factor authentication (MFA) is working as intended for all services possible. ✅ Confirm software and operating systems are up to date to download the latest security patches. ✅ Scan for open and unused ports and remove any application not deemed necessary for day-to-day operations. ✅ Add an email banner to emails received from outside your organization to warn employees. More Information 🔒 FBI - Ransomware Awareness for Holidays and Weekends https://www.cisa.gov/uscert/ncas/alerts/aa21-243a 🔒 Why do cyber-attacks increase during holidays? - Security Boulevard https://securityboulevard.com/2022/12/why-do-cyber-attacks-increase-during-… https://www.linkedin.com/pulse/prepare-now-holiday-weekend-cyberattacks-ris… Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.” CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

account set up
by Jamie J. Arcaro Dec. 10, 2024

Dec. 10, 2024

I did not received the email to verify my email address when setting up an account. Can you please assist? Jamie J. Arcaro Ashtabula County Commissioners Workers' Compensation and Risk Specialist 25 West Jefferson Street Jefferson, OH 44047 Phone: 440-576-3748 Fax: 440-576-2344

1 0