Whitcombe Dunmore Ltd, a mid-sized firm with 1,140 employees and a communal fridge nobody has cleaned since March, has concluded its Cyber Security Awareness Month with a phishing simulation click rate of zero per cent. The board described the figure as unprecedented. It has since been reported to IT as suspicious.
The trouble began on Thursday morning, when HR sent an all-staff email headed “Annual Pay Review Outcome”. It confirmed a rise of 0.4 per cent, backdated to April and payable from the November run. Within eleven minutes, 612 people had forwarded it to the helpdesk. By lunchtime the total stood at 1,127, the remainder being nine colleagues on annual leave and four who had not opened it on the grounds that they had been trained not to open things.
The month had gone well, by every measure the company knew how to take. Staff had been sent simulated messages offering a surprise bonus, a parcel that could not be delivered, a request to confirm holiday entitlement and an urgent update about the car park. They had learned to check the sender, hover over links and report anything unusual, in line with the National Cyber Security Centre guidance that the firm had printed, laminated and fixed to the door of every lift.
“We looked at it again afterwards, and it was quite clearly a scam, because it had a figure in it,” said Helen Prowse, head of internal communications. “Genuine communications from HR have never contained a figure. They contain phrases like ‘we value your contribution’ and ‘in line with market conditions’. A number is what a criminal would send.”
Priya Natarajan, a senior accounts coordinator, said she had given the matter proper thought before reporting it. “It said 0.4 per cent. I have worked here for nine years and nobody has ever offered me 0.4 of anything. It had to be bait. Nobody real would offer so little with such confidence.”
A difficult week for the second floor
HR attempted to verify the email by telephone, but staff no longer answer calls from internal extensions they do not recognise, and the department’s direct line was reported by fourteen people in under an hour. A follow-up email titled “Please disregard previous email, previous email was genuine” was reported by 1,131 people and described by one as “textbook”.
A member of the HR team then walked the length of the open-plan office with a printed copy of the announcement and a lanyard. She was asked for photographic ID at nine separate desks, and then reported for tailgating by a man who had held the door for her.
“I have been through the headers. It came from the HR address, passed every check and was signed by a woman I have had lunch with. That is exactly what a good one looks like.”
Darren Elkins, the firm’s only IT security analyst, delivered this assessment from behind a monitor displaying a queue of 3,412 tickets. “Policy says I have to investigate every report,” he said. “I have also been told, in a very nicely formatted email, that I am doing a wonderful job. I have reported that as well.”
The queue now includes reports of the reports. The helpdesk’s automatic acknowledgement, which reads “Thank you for helping to keep us safe”, has itself been flagged by 212 members of staff as a likely attempt to harvest goodwill. Payslips are being returned unopened, a P60 has been quarantined in a drawer, and the canteen has been asked to prove that Thursday’s soup is the one on the menu.
Management has not yet decided how to communicate the pay rise in a way that will be believed. Options under discussion include a handwritten note, a notice in the lift and a man in the car park with a sandwich board, though the last of these has been described as exactly what an attacker would do.
At 10am on Friday, the building’s weekly fire alarm test sounded as scheduled. Nobody moved. Several people looked up at the ceiling, and by 10.05 the helpdesk had received forty-one reports asking whether it was a genuine test or merely a very convincing one.
