Not one of the 340 employees at Brindlecombe Ledger & Sundry has opened an email announcing a 4.2 per cent pay rise, backdated to April, after each of them independently concluded that it was a test. The message was sent from the human resources inbox at 9.15am on Tuesday and remained unread by every recipient for six days, a result the company’s security team has described as its best on record.
The email carried the subject line “Important: Action Required Regarding Your Remuneration” and invited staff to click a button marked “View My New Salary”. It was, by any reasonable reading, exactly the sort of thing that a criminal would send, and also exactly the sort of thing that a department that had finally won an argument with finance would send. Staff chose the first interpretation, as they have been trained to do since 2021.
A culture of vigilance
October is Cyber Security Awareness Month, and the firm has marked it with the usual programme of mandatory e-learning, a laminated poster in the lift and a fresh round of simulated phishing emails. Previous entries in the series have included a notification that a parcel could not be delivered to a building that does not accept parcels, an alert about an unusual sign-in from Slough, and a warning that the recipient’s car had been clamped in a car park that has never contained a clamp.
Graham Pettifer, Head of Information Security, said he was quietly pleased with the outcome. “We have spent four years teaching people to distrust anything urgent, anything generous and anything from head office,” he said. “It is gratifying to see it hold, even in the one instance where the generous thing turned out to be real. I have a spreadsheet, and the non-click rate is a hundred per cent. I will not be taking questions about the context.”
The National Cyber Security Centre continues to urge employees to report anything suspicious, and the staff at Brindlecombe have taken this to heart. By Wednesday afternoon the pay rise email had been reported to IT 61 times, once by a director.
“It said I had been awarded an additional £1,860 a year. Nobody has ever been awarded anything by this company, apart from a disciplinary.”
The most diligent of those reports came from Neil Sutcliffe, a senior accounts assistant, who forwarded the message to the helpdesk with a short note explaining that the sender’s address looked correct, which he found suspicious in itself. “I reported it and, to be fair to them, they were very quick,” he said. “Within the hour I had a certificate in my inbox. It says ‘Well Spotted’ and has a small cartoon owl on it. I have put it on my desk next to the one from March, which was for the clamped car.”
Human resources requests a reply
In the meantime, the HR department has begun to wonder why nobody has said anything. The original email asked staff to confirm their new salary by Friday using the link provided, and by Monday morning it had received no confirmations, no queries and no thanks.
“I would have expected at least one person to ask whether it was backdated,” said Alison Threlfall, HR Business Partner. “We then printed it out and left a copy on every desk, in case there was a problem with the email. Several people photographed the printouts and sent them to IT. One person has asked whether a piece of paper can be spoofed. I do not know what to tell her. It is money. We are trying to give them money.”
A follow-up email, headed “This Is Not A Test”, was sent on Thursday and was also reported, on the grounds that this is precisely what a test would say. Mr Pettifer has since confirmed that the line appeared in the March simulation, and that he had written it himself.
The security team is understood to be reviewing its approach, although no changes are expected before the end of the quarter. The company’s canteen satisfaction survey, which asks staff to rate the soup on a scale of one to five, is meanwhile being treated as a sophisticated spear-phishing campaign, on the grounds that nobody at Brindlecombe has ever cared what anyone thought of the soup.
