Yesterday, April 23, the twitter account of the AP wire service was compromised. The perpetrators sent out a fake tweet from the real AP account saying that the President had been injured in a bombing at the White House. There was no bombing.
Jay Carney Confirms President is Fine
This is the tweet that cost $140 billion in lost stock market value.
How could this have happened? It happened because a spearphishing email tricked an employee of AP into compromising the credentials to AP’s twitter account. With the credentials in hand, the attackers were free to use the twitter account for their own purposes.
As Jim Romenesko reported, AP staff were warned that they were under attack by a spearphishing email. But that warning came too late. Warnings always happen after the attack starts because, in the absence of time travel, an attack specific warning cannot be issued before the attack is discovered. Had AP been using SP Guard from Iconix, employees would have been able to easily determine that the email that pretended to be from a colleague was fake.
To learn more, you can contact us at 408-727-6342, ext 3 or use our online form.