Spain’s National Cybersecurity Institute (Incibe) assisted a company whose billing system had been tampered with, redirecting customer payments to fraudulent bank accounts, according to the agency.
The company’s manager contacted Incibe’s confidential helpline, 017, after noticing suspicious activity. He told advisers that about a week before his call, staff had detected unusual behaviour on several computers, raising fears of an intrusion.
A review of the system revealed that the invoicing software had been generating invoices carrying a fraudulent account number. Those invoices had already been emailed to clients, and some had made payments to the wrong account.
Incibe advisers told the manager to contact the billing software provider to review the incident and apply appropriate security measures. They also recommended changing the programme’s password, enabling two-factor authentication where available, and running a full antivirus scan on all affected machines.
On the email side, Incibe said the company should check forwarding rules and filters, review access logs for unauthorised connections, and reset passwords with two-factor authentication enabled.
Incibe also urged the firm to report the data breach to the Spanish Data Protection Agency and consider commissioning a forensic audit to establish the full scope of the intrusion before filing a complaint with law enforcement.
