Salesforce.com Employee Falls For Phisher Ploy

If you are a Salesforce.com customer, you may have noticed a prominent phishing alert message on the log-in page. Initially I assumed that Salesforce had been notified of increased activity in this area and were just posting the warnings in the interest of their customer base.

Not quite.

Based on a recent eWeek article, Salesforce.com had very good reason to want to warn its customers about potential phishing scams. Apparently, a list of Salesforce.com customers was leaked by a Saleforce.com employee who fell for a phishing scam him or herself, and revealed his or her own password that then led to a customer contact list being copied, according to Parker Harris, executive vice president of technology at Salesforce.com.

The contact list contained first and last names, company names, e-mail addresses, telephone numbers of Salesforce.com customers, and related administrative data belonging to Salesforce.com.

The phishing attempts have gotten worse in the past few days, with a new wave of e-mails with attached malware, including viruses or key loggers. This new onslaught is apparently targeted at a broader group of customers, Harris said. Initially, according to Salesforce.com, a "small number" of customers were the recipients of emails that resembled Salesforce invoices and were phishing for password information.

I'm curious as to what the original message to the Salesforce.com employee would have said to give them the impression that it was okay to part with something as valuable as customer data?

This should give your organization the incentive it needs to make sure you have a policy for how your customer information is accessed and, especially, what the proper protocol is for distributing it internally and externally.

There should be no phishing offer compelling enough or deceptive enough to wrest your organization's information "crown jewels" from an employee.

Contributed by Mark Tordoff