What happened
Industrial cybersecurity firm Dragos disclosed on 10 May 2023 that a criminal group had compromised the personal email address of a newly hired sales employee before their start date and used it to impersonate them through the onboarding process. The attacker reached SharePoint resources and the company's contract management system, and viewed a report containing customer IP addresses. Ransomware deployment failed, and the group turned to extortion, messaging Dragos executives and referencing family members. Dragos did not pay.
How the deception worked
The attacker targeted the gap that exists before a new hire's first day, when the person has an accepted offer but no corporate identity yet. Having taken over the recruit's personal email, the criminal completed the onboarding steps in their name, receiving credentials and access as the company believed it was equipping its own new starter. That produced legitimate access to onboarding-tier resources including SharePoint and a contract system. When ransomware deployment failed, the group escalated to personal pressure, contacting executives' private accounts and naming relatives to force negotiation. Dragos's SIEM alerts surfaced the activity and the account was blocked.
The control that would have caught it· our reading, not a claim from the sources
Onboarding must verify identity through a channel independent of the address on the offer letter, and new-hire accounts should start with minimal access under heightened monitoring.
Sources (2)
- Deconstructing a Cybersecurity EventDragos·dragos.comOpen ↗
- Cybersecurity firm Dragos discloses cybersecurity incident, extortion attemptBleepingComputer·bleepingcomputer.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.