A growing number of phishing attacks are making headlines today. Phishing is arguably the most common type of cyberattack, with millions of incidents recorded yearly. Famous phishing attacks are often worst-case scenarios but can also be valuable examples to learn from.
1. AOL Email Scams (1995)
The 1995 AOL phishing attack was one of the first on record and the term’s origin. Known as “AOHell,” this large-scale scam targeted America Online’s email service users. At the time, AOL was one of the largest internet providers in the country, creating a huge pool of potential victims.
The AOHell hackers used a few different phishing tactics, including credential theft. The scheme started with a credit card number generator the scammers used to find real credit card numbers and make fake accounts. They also used AOL’s instant messaging system to pose as employees and convince victims to relinquish financial or account data.
AOL successfully shut down the fake credit card arm of the AOHell scheme but was able to do little against the fraudulent instant messages. Luckily, account security technology has improved significantly since 1995.
However, the key takeaway from this case is to never implicitly trust messages that claim to be from customer service or a business. Always reach out to that company directly and verify the legitimacy of messages. It’s also important to closely analyze the sender’s information to spot red flags like suspicious domain names.
2. Target Customer Data Theft (2013)
The 2013 Target data leak is one of history’s most famous phishing attacks. This incident involved the theft of millions of Target customers’ financial data after a supplier was attacked.
The data leak started with Fazio Mechanical, a third-party vendor that supplied Target’s refrigeration systems. At least one employee was fooled by a phishing attack that allowed hackers to install the Citadel malware program on Fazio’s computers. This malware program stole employee login credentials, allowing the cybercriminals to enter Target’s systems.
There is a lot to learn from this complex attack. Businesses should note the origin of this data leak – a third-party vendor. Suppliers, partners and others can be major cybersecurity risks.
The 2013 Target data leak might have been prevented if Fazio Mechanical had high-quality cybersecurity software installed on its computers. The vendor and business must implement the highest level of security possible without hurting limiting functionality.
3. Facebook and Google Spear Phishing Attack (2013 – 2015)
One of the most famous phishing attacks hit Facebook and Google servers from 2013 to 2015. The incident wasn’t revealed to the public until 2017 when a single Lithuanian man was charged with running the entire cybercrime operation. Google and Facebook combined lost over $100 million due to this attack.
The hacker used spear phishing emails disguised to look like messages from a manufacturing partner. Google and Facebook employees were tricked into making large transactions to the hacker, thinking they were legitimate payments to their manufacturing partner. Facebook recovered most of the money it lost, but both companies were defrauded of millions of dollars.
This case is another lesson in the dangers of implicit trust. A hacker who does their research can easily pose as someone their victim will likely trust without thinking twice. They bet on the victim not taking the time to double-check the sender’s email address or contact them over another channel. Always ensure the sender’s legitimacy before sending anyone credentials, money or financial data.
4. Celebrity Apple Spear Phishing Scheme (2019)
Some of the most famous phishing attacks target individuals rather than large corporations. This is the case in a 2019 phishing scheme that targeted numerous celebrities. A 27-year-old hacker from Georgia posed as a representative of Apple in emails asking celebrities to send login data to “reset” or otherwise protect their account.
The hacker stole thousands of dollars from high-profile victims ranging from rappers to professional athletes. This scam is a great example of spear or “whaling” phishing attacks, which include personalized messages and target specific people. The celebrities in this case were likely used to Apple representatives contacting them personally.
While this attack targeted celebrities, everyone can learn from it. No business or legitimate organization will ever ask someone to send login information over email. Messages like this should always be treated as suspicious, no matter who you are.
5. Colonial Pipeline Hack (2021)
The 2021 Colonial Pipeline attack is one of the most high-profile in recent years. This cyberattack made headlines and threatened the availability of fuel for millions of people.
Colonial Pipeline is America’s largest oil pipeline, serving a dozen states. So, it was a serious problem when it was forced to temporarily shut down in 2021 due to a ransomware attack. The cyberattack started with phishing, though.
Employees’ passwords and account details were leaked through the dark web. The hackers took advantage of this weakness along with others, including an unsecured VPN and a remote desktop sharing app. All these vulnerabilities allowed the criminals to get ransomware into Colonial Pipeline’s systems, forcing it to pay millions of dollars to get the system back online.
Several things could have prevented this attack. For example, training employees to recognize malicious emails might have helped them avoid falling for phishing messages.
Additionally, using multifactor authentication to secure employee accounts could have prevented hackers from using stolen passwords. Anyone can use MFA to protect their information online, and it’s worth taking the time to set up.
Learning From Famous Phishing Attacks
The most famous phishing attacks are notorious for stealing millions of dollars or large amounts of data. However, it’s important to remember that these are worst-case scenarios. Studying them can help people avoid falling victim to large-scale cyberattacks. Everyone can protect themselves from phishing by learning the signs of a malicious email and utilizing tools like MFA and password managers.
