Phishing Campaign Exposes 67,943 Email Addresses and Passwords – CERT Poland
What Happened
In August 2023 CERT Poland disrupted a phishing operation that harvested credentials from ≈ 68 k victims. The attackers sent emails masquerading as purchase‑order confirmations, directing recipients to a malicious login page that captured email addresses and passwords. Analysis later linked the campaign to a shared command‑and‑control server that hosted > 200 related phishing attempts before being taken down.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous credential‑monitoring controls that can detect compromised accounts and trigger evidence‑based remediation.
- Highlights the importance of enforcing multi‑factor authentication (MFA) and password‑policy enforcement as part of a defensible control‑assurance program.
- Shows that breach‑response documentation (e.g., incident logs, third‑party notifications) is essential for meeting audit requirements under frameworks such as NIST CSF, ISO 27001, and GDPR.
Who Is Affected
- Financial services firms handling invoicing or purchase‑order workflows
- E‑commerce and retail platforms that communicate order confirmations via email
- Public‑sector entities using government‑issued email domains
- Any organization whose users may receive unsolicited purchase‑order‑style emails
Recommended Actions
- Review exposure of corporate email domains to phishing‑derived credential leaks.
- Validate that MFA is enforced for all privileged and remote‑access accounts.
- Activate or enhance credential‑leak monitoring services and integrate alerts into your SIEM.
- Update phishing‑awareness training to include purchase‑order‑confirmation scenarios.
- Document the incident response steps taken and retain evidence for audit trails.
Technical Notes
- Attack vector: Phishing email with malicious login page (credential harvesting).
- CVEs: None reported.
- Data types exposed: Email addresses, passwords (clear‑text or reused credentials).
Source: https://haveibeenpwned.com/api/v3/breach/CERTPolandPhish