A hack doesn’t stop with stolen data: why phishing becomes even more dangerous afterwards

At the beginning of August, logistics provider CEVA was hit by a cyber incident. This immediately had consequences for several well-known organisations that use CEVA’s services, including Bol.com and Ajax. At Bol.com, customer data needed for processing and delivering orders may have been accessed or copied. This included names, addresses, email addresses, phone numbers, order numbers and purchase details. Bol.com’s own systems were not affected.

A data breach is serious enough. But the risk does not end once the attack is over.

The data stolen during such an incident can make it much easier for cybercriminals to create phishing messages that look convincing.

When a phishing email suddenly looks very real

Many people still associate phishing with suspicious emails full of spelling mistakes and sent by unknown senders. In reality, phishing can be much more subtle.

Imagine this: you recently placed an order with a well-known online retailer. A few days later, you receive an email saying there is a problem with the delivery. Your name is correct, the message sounds familiar and it may even refer to a product or delivery you recognise.

That makes it much more likely that you will think: this must be legitimate.

That is exactly why stolen personal data can be so valuable to cybercriminals. The more genuine information they have, the easier it becomes to make a message look personal and trustworthy.

After the incident, Bol.com explicitly warned affected customers to remain alert to phishing and other forms of fraud. The company advised customers to carefully check the sender of messages, avoid clicking links in unexpected emails and not share personal information when asked to do so unexpectedly.

Phishing is increasingly based on trust

A phishing attack does not have to be technically complicated.

Cybercriminals are mainly trying to achieve one thing: getting someone to take action.

For example:

• clicking on a link;
• opening an attachment;
• entering login details;
• sharing personal information;
• making a payment;
• or responding to a supposedly urgent request.

These messages often play on familiarity, time pressure and trust.

An email from your bank. A parcel delivery company reporting a problem with your shipment. A message from a colleague or manager. Or an online store where you have actually placed an order.

That is exactly what can make a phishing email difficult to recognise.

Not just a problem for the IT department

Cybersecurity is still often seen as something that mainly concerns the IT department. Of course, technical security measures play an important role, but employees ultimately receive emails, open files and work with different systems every day.

That is why awareness is just as important.

Employees do not need to become cybersecurity specialists. They mainly need to know when to stop and take a closer look.

Is the sender’s email address correct?
Where does that link actually lead?
Why am I suddenly being asked to act so quickly?
Does it make sense that I am being asked for information or a payment via this email?

Taking just a few extra seconds to think can already make a difference.

What can you do when you receive a suspicious email?

If you are unsure about a message, do not click on links or attachments straight away.

First, check the sender and take a critical look at the email address. If in doubt, go directly to the organisation’s website instead of using the link in the email. Is an unusual request being made on behalf of a colleague or supplier? Verify it through another channel.

And perhaps most importantly: make sure employees know where they can report a suspicious message within the organisation.

An employee who has doubts and reports an email is not a problem. In fact, that is exactly the kind of behaviour you want to encourage.

Recognise phishing in 5 to 10 minutes

Fortunately, awareness does not have to mean hours of training.

In our Phishing Email e-learning, employees learn in approximately 5 to 10 minutes how to recognise phishing emails and how to respond safely to suspicious messages.

The training covers suspicious senders, misleading links, urgent requests and other commonly used tactics. Practical examples and interactive exercises directly connect the knowledge to situations employees may encounter in their daily work. The training is fully online, suitable for all employees and concludes with a final assessment and certificate.

View the Phishing Email e-learning

A small investment in awareness

A cyber incident at a large organisation may seem far removed from your own working day. However, the CEVA incident shows how data from one organisation can have consequences for customers and employees of many other organisations. Ajax later confirmed, for example, that the incident involved information such as names, email addresses, postal addresses, phone numbers and order details. According to Ajax, payment details and passwords were not involved.

You cannot prevent every cyber incident.

But you can teach employees to take just a little more time to think before they click.

And sometimes, five minutes is all it takes.