Japan Data Breaches Raise Fears of Personalized Phishing Emails

The number of unique phishing URLs had not dropped as sharply. The council reads this as a decline in mass-mailing of identical URLs, and warns that large-scale distribution could return once attackers rebuild their infrastructure.

Security firm Check Point Technologies also sees more phishing emails. Their content has not changed much, it says, but attacks increasingly target companies that offer attackers a payoff. It stresses that a connection to the leaks has not been established.

Why personalization matters

Check Point says leaked data could sharpen targeting. Familiar lures such as a failed membership-fee payment or an extra charge could reach people who might actually face such a situation. Combining different leaked data sets would also make a target's profile clearer and convincing phishing scenarios easier to build, the company expects.

Tobila Systems, which provides scam call and email countermeasures, did not disclose detection figures. It says scams abusing personal data are likely to grow, and it has already seen emails with personal details and URLs that differ from message to message. That points to a shift from indiscriminate mailing toward targeting individuals.

What to do

Individuals are advised to enable multi-factor authentication and avoid opening URLs directly from emails. Companies should be wary of messages posing as customer support or internal IT and training departments that demand urgent action. Check Point singles out calendar invitations with .ics attachments and notices that appear to come from Microsoft tools, and recommends passing them to security staff first.