18 May, 2021
Friends of ISSA-COS,
Recently, the Colorado Springs Chapter of the Information Systems Security Association (ISSA-COS) identified anomalous activities associated with the email account belonging to our Director of Communications. Fortunately, our director quickly recognized the odd activities and immediately notified our IT Committee. Our IT Committee shifted into Incident Response mode and conducted a swift and thorough investigation while isolating the affected email account before further harm could be performed.
Later, the incident investigation revealed ISSA-COS had sustained an external breach against the affected email account. It was also determined a subset of internal and external email addresses were exposed along with an undisclosed number of historical emails. The actor(s) of this attack are now using the gathered information to send phishing attacks to the individuals for whom the stolen email addresses belong. We are not sure how long these phishing attacks will persist. The characteristics of these phishing emails include the following:
- A spoofed email name implying the sender is “(Communication&issa-cos org)”. Note the “&” and space between “cos” and “org” are not characteristics of our chapter domain name
- A sender address not associated with ISSA-COS; “(Communication&issa-cos org) <sender address>”
- Poorly written English and a salutation that may or may not include the recipient’s name
- A hyperlink to a non-chapter related ZIP file – the contents of which may include malicious files.
ISSA-COS is encouraging anyone who receives an email communication from “(Communication&issa-cos org) <sender address>” to immediately purge the email from their account. NOTE HOWEVER: email communications received from “Communications@issa-cos.org” are legitimate and can be trusted.
Other than a subset of personal, public, or professional email addresses, no other Personally Identifiable Information (PII) has been found to be compromised. Since ISSA-COS is a public non-profit organization, we do not store, process, or transmit proprietary information and most of our operational information is publicly available information. This makes us and the information we store of moderately-low to low value outside our organization.
On our end, we have taken the following steps:
- We have reported the incident to our email service provider
- We have isolated and remediated the affected email account
- We have instituted a required password reset on all chapter email accounts
- We have made efforts to contact known recipients of the compromised email addresses
- We have reported the incident to the Chief of Operations (COO) of ISSA International
- We are reviewing the security applications, processes, and procedures in place within our organization.
On behalf of ISSA-COS, I apologize for the incident and vow to institute stronger measures to protect our members and our community at large. We encourage you to use this incident as a reason to review, update, and socialize the security practices in place within your own businesses and organizations. Remember, none of us are entirely safe from Cybersecurity attacks but, with a little effort we can be safer. For additional information or questions, please contact us at info@issa-cos.org.
Sincerely,
Ernest M. Campos
President, ISSA-COS