FOR INTERNAL DISTRIBUTION. Norbury Sprocket & Fitting Group, Reading.
The IT Service Desk at Norbury Sprocket & Fitting Group is pleased to announce that the October phishing report rate has reached 100 per cent. This is the highest figure since records began in the second quarter of last year, when it stood at 11 per cent and nobody had yet thought to put it on a dashboard.
Every one of the company’s 1,412 employees has now reported at least one email as suspicious. The service desk received 9,806 reports during the month, an average of 6.9 per head, and has colour-coded the trend in green, which the dashboard uses to indicate success.
Reports of note
Among the messages flagged were the annual pay review letter, reported by 212 colleagues, several of whom added the comment “obviously fake, nobody is getting 2.1 per cent”. The fire drill notice for Thursday at 10.30 was also reported, as was the date of the office Christmas party, which staff described as “weirdly early and weirdly specific”.
An email from the Chief Executive, Giles Pemberton-Hale, was reported 340 times. Colleagues cited the fact that it began “Hi all” and contained no spelling mistakes, a combination none of them had previously encountered from him.
The Cyber Security Awareness Month reminders sent by IT itself have been reported in their entirety. This includes the one that read “If you see anything suspicious, please report it”, which was reported as suspicious by 61 people, who were then thanked automatically.
“We set out in January to build a culture of vigilance, and I think the numbers speak for themselves. What they say is 9,806.”
Derek Halloran, Head of IT Service Delivery, said the department had never been prouder. “Previously we measured how many people clicked on things, which was a negative metric and made everyone feel watched. Now we measure how many people tell us about things, and the number only goes up. Nobody has asked what it is going up towards, and I would not want to discourage that.”
The service desk acknowledges a modest rise in its own workload. Two analysts are now dedicated to reviewing reports, and a third has been seconded from the team that used to fix laptops. Laptop fixing has been paused pending a decision on whether it counts as a security function.
Areas for continued focus
The department is aware of one email received on 14 October from an address beginning “hr-paymentz”. It was addressed to “Dear Valued Employe”, requested gift cards to the value of £500 “for staff apreciation”, and was signed “Mr Giles Pemberton Hale, CEO” above a phone number with too many digits. It has not been reported by anyone.
Colin Briggs, an accounts payable clerk who received the message, explained his reasoning. “I did think about reporting it, but it was too rubbish to be a test. Our tests have logos and a proper sign-off. This one had a typo in the subject line, so I assumed it was real and that someone senior was having a difficult week.”
Priya Nandakumar, a facilities coordinator, said she had also seen it. “I flagged the fire drill email because it said to assemble by the bins, and we have never assembled by the bins. This one just seemed like a normal Tuesday.”
Two members of staff did purchase gift cards, a total of £350 in vouchers for a well-known online retailer. Both subsequently reported the purchase as suspicious, which the service desk has logged as two successful reports and a further improvement to the rate.
Mr Halloran confirmed that the figure for next month is expected to be 100 per cent again, and that the target for the following quarter has been revised to 110.
