‘Watering hole’ hack: scammers using online menus to steal company information from hungry workers

Thinking about what to have for lunch? Here's why you should think twice before downloading a restaurant menu at work.

Criminals are targeting workers using restaurant menus in order to harvest information about the business they work for.

In the latest cyber scam, known as the ‘watering hole’ hack, criminals plant viruses on popular restaurant websites that are located near the office of the business they want to target.

When the time comes for hungry workers to browse the menu, the virus is downloaded to their computer which allows the criminals to access information on the machine.

“Sometimes, especially near organisations that are targeted, let’s say there is a major corporate office near this restaurant, they may infect the restaurant and when you download the PDF version of the menu it is infected,” Chris Furlow, president of US risk company Ridge Global, told the World Credit Union Conference in Belfast.

“They may be coming after a specific individual because they have inside information about what is going on within your organisation.”

 British intelligence agency GCHQ admits that these type of scams have made it to the UK. It recently identified a watering hole attack against a web design company that works with a number of UK companies. It’s believed it was part of a continuing commercial espionage campaign.

In 2014 Forbes.com was breached in a watering hole attack aimed at US financial and defence companies that used the website. It is believed Twitter, Microsoft, Facebook and Apple have also been attacked using the watering hole technique.

Protect yourself and your company

To protect themselves companies need to educate their staff to be on their guard, says Furlow. A quarter of data breaches involve human error, according to a report from tech firm IBM.

“That should be striking, it is something that should concern you,” says Furlow.

“This is about employees or third parties like contractors who are in some way negligent. I think that is a tough term in the environment today, negligent, because there are some people who just don’t have the resources or they do not have the training in order to understand what they need to be doing.”

Companies should also monitor the 100 websites most visited by their employees. Those sites should be inspected for malware on a regular basis and blocked if they are hosting malicious links.

If it is a website employees need to use then businesses should contact the website and warn them they are infected.

Individuals should make sure they keep their virus and internet security up to date and switched on. Many of these systems will warn you if you are visiting a website that contains malicious links or coding.

And, as ever, don’t click on links in unsolicited emails or type your details into unsecure websites.

Afraid that you've had your details stolen? Check your credit report for unusual activity. Get free access for 30 days with Equifax and Experian with loveMONEY.

Learn more about scams:

New mobile phone scam

How criminals steal your banking details at an ATM

Beware the product testing scam

Scammers' card machine cons - how to spot them

Comments


Be the first to comment

Do you want to comment on this article? You need to be signed in for this feature

Copyright © lovemoney.com All rights reserved.

 

loveMONEY.com Financial Services Limited is authorised and regulated by the Financial Conduct Authority (FCA) with Firm Reference Number (FRN): 479153.

loveMONEY.com is a company registered in England & Wales (Company Number: 7406028) with its registered address at First Floor Ridgeland House, 15 Carfax, Horsham, West Sussex, RH12 1DY, United Kingdom. loveMONEY.com Limited operates under the trading name of loveMONEY.com Financial Services Limited. We operate as a credit broker for consumer credit and do not lend directly. Our company maintains relationships with various affiliates and lenders, which we may promote within our editorial content in emails and on featured partner pages through affiliate links. Please note, that we may receive commission payments from some of the product and service providers featured on our website. In line with Consumer Duty regulations, we assess our partners to ensure they offer fair value, are transparent, and cater to the needs of all customers, including vulnerable groups. We continuously review our practices to ensure compliance with these standards. While we make every effort to ensure the accuracy and currency of our editorial content, users should independently verify information with their chosen product or service provider. This can be done by reviewing the product landing page information and the terms and conditions associated with the product. If you are uncertain whether a product is suitable, we strongly recommend seeking advice from a regulated independent financial advisor before applying for the products.