The following notice is posted on behalf of the Lawyers’ Insurance Association of Nova Scotia (LIANS)
The RCMP’s National Cybercrime Coordination Centre (NC3) has identified a cyber threat targeting Canadian law firms.
Though we are not aware that this particular threat has been made in Nova Scotia, LAWPRO in Ontario has received claim reports from firms that have experienced breaches or been targeted in the manner described by the RCMP. There is no reason to think this threat will not make its way here.
The nature of this threat is as follows, as described by LAWPRO in a recent note to its insureds.
Cybercriminals are contacting lawyers or law firm employees by phone and posing as the firm’s IT helpdesk. The callers claim an urgent security change is required and direct the employee to a fraudulent login page that is made to look like it is a legitimate firm page. We have warned members in the past about spoofed law firm websites.
When the employee or lawyer enters their username and password on this fraudulent login page, they are giving their credentials to the cybercriminals. The cybercriminals will then use those credentials to breach the law firm’s systems.
The spoofed domains for these login pages will incorporate the law firm’s name or a variation of it, together with other words. Examples include (and the word “dot” is used rather than an actual dot to make sure the domain cannot become a live or true hyperlink):
- LawFirmName dot configuremysso dot com
- LawFirmName dot myaccountoptions dot com
- LawFirmName dot myaccountsetup dot com
- LawFirmName dot addsecureapps dot com
This is not an exclusive list, just examples of what you could expect to see if you are a target.
As we have been saying for some time, you and your employees have to be alert and aware of social engineering scenarios. Do not assume a caller is from your IT department simply because they know information about you or your firm or that the web address provided by the caller includes your firm’s name or because they say they are. The callers – the fraudsters – will sound legitimate and be persistent. They always do and that is how they succeed.
YOUR NEXT STEPS
Alert Staff: Staff are likely to be the targets for these calls, which can also start as emails. Make sure everyone at your firm is aware of these scenarios and knows that cybercriminals may impersonate internal IT personnel.
Stop and Verify: If you receive an unexpected call or message from someone claiming to be from your firm’s IT department, end the communication. Contact your IT department using a known and trusted phone number or other established internal method.
Report: If you believe your credentials have been compromised, please contact your IT department immediately, report the incident to LIANS and contact your cyber insurer.
Cybercrime and fraud can also be reported to the RCMP and Canadian Anti-Fraud Centre through the National Cybercrime and Fraud Reporting System.
Check out LIANS LIANSwers newsletter for other recent Fraud Alerts and updates from the insurer.