Some signs of a phishing scam, like a strange email address or an obvious misspelling, can be easy to spot and avoid. But these attacks are becoming more sophisticated as they become more widespread. DocuSign is the latest company to have been attacked, and once they realized, began spreading the word to their customers via social media and on their DocuSign Trust Center webpage.
DocuSign first spotted an uptick in phishing emails imitating the company’s branding. When they investigated further, it became clear they’d been hacked; a malicious third party broke into one of their non-core systems used to send out service announcement emails. The phishing campaign then targeted the customers, sending an email asking recipients to download a Word document and once downloaded would install malware. DocuSign has stated that a forensic analysis confirmed only a list of email addresses were accessed, but no names, physical addresses, passwords, or other information like credit card data was compromised. The company has also confirmed that their core eSignature service, envelopes, and customer documents and data have remained secure.
DocuSign recommends many steps to their customers to ensure the security of their email and systems. They give out the two subject lines being used in the phishing scam so customers can recognize and delete these right away. They have set up a spam@docusign.com email for customers to forward any suspicious emails to, and enable the customer to then delete their copy of the email. Lastly, they recommend enabling and updating anti-virus software. To learn more about the recent attacks, visit here.
