As we have all seen on the news, a cyberattack is behind a province-wide disruption of health-care services in Newfoundland and Labrador that has affected thousands of appointments and procedures, including those involving COVID-19 testing.

This appears to have been caused by a cyberattack by a third party. An attack that hit “the brain of the data centre” that powers the province’s health-care system.

Given this terrible news, I wanted to pass along this graphic that lays out the major red flags of social engineering. 

The best and easiest way to avoid being the victim of scams, like social engineering, is to educate yourself so you are able to identify key factors that point to something being real or a scam. Social engineering is when a social engineer manipulates people so that they give up confidential information, in other words, when someone is masquerading to be someone they are not and using emotional triggers to get you to take an action. This information can vary but most often the criminals are trying to get access to your banking information, passwords, or access your computer to install a malicious software that will give them access to all this information and give them full access to your computer.

It is very common for social engineering to take place through emails. The emails will usually implore urgency, fear or other emotions in the victim which can lead this victim to reveal sensitive information, click a malicious link, or open a malicious file. 

The following information is going to help you better understand what to look for and things that can help you distinguish between a social engineering email and a regular email. 

1. Sender and domain

• Is this someone you have or often communicate with?
• Is this someone outside or inside your organization?
• Do you have any business relationship or past communications with this sender?
• Is the sender’s email domain suspicious?

In this case, the sender’s name is someone who is recognized  as someone inside the organization; however, the domain of where the email has been sent from is not familiar and in turn, a big red flag. This indicates that this email is a scam.

2. Date and time

• Was this email sent during your regular business hours?
• Was this email sent at an odd time? Like the middle of the night

This particular email was sent at 3:54 AM. Usual business hours are between 8:00 AM AND 5:00 PM. This is a red flag due to the very early time this email was sent.

3. Subject line

• Is the subject line relevant?
• Does the subject line match with the email body content?
• Does it invoke a sense of worry, fear, or urgency?

Right away this email invokes a sense of urgency and a need for immediate action. Emails with subject lines like this should always be reviewed cautiously, especially if the body of the email is asking for sensitive and/or private information.

4. Email content

• Is this email out of the ordinary?
• Does it have spelling mistakes or improper grammar?
• Does it ask you to click on an attachment or link?
• Does it imply that by doing what it is instructing, you will avoid a negative consequence or gain something of value?

Right from the start you can tell that this email is filled with spelling mistakes. This is a big indicator that it is a possible scam. This email is also prompting you to open a file and fill out personal information to be sent back ASAP in order to gain a bonus, which is something of value. You should never send personal, sensitive information over email to anyone that is not a recurring contact, or without verbally confirming with the alleged sender of the email first. Even then you should consider sending sensitive information like this in a more secure way.

5. Attachments

• Does this sender usually send you this type of attachment?
• Were you expecting this email with this attachment?
• Is the attachment a familiar source? 

The only file type that is safe to click on is .txt files. Any email that comes through with an attachment should always be checked through to identify if it is a possible scam and then checked through again. You should only open an attachment from an email if you are 100% confident you know what it is and it is coming from a trusted sender.

Cyber Risk Assessment 

At Cal LeGrow, we offer a free (online) cyber risk assessment to find out how many cyber exposures your company may have and how we can reduce those exposures together. 

But, even if we do everything we can to reduce those exposures, there is still always a possibility of a cyber attack. To make sure your company and employees are safe, you should consider getting a cyber policy. 

Click here to complete the cyber risk assessment, and once you’ve submitted, your account manager will reach out to further discuss your cyber policy.