What is Whaling & How to Protect Yourself?

Michelle Wilson - November 19, 2021

what is whaling and how to protect yourself

While everyone is aware of phishing attacks and their influence on personal information, there’s a more significant type of scheme that puts corporations and businesses at risk. Whaling attacks cost potential businesses data and financial loss, disruptions of service, and more. Here’s everything you need to know to help you understand what whaling is and how to protect yourself.

What is a Whaling Phishing Attack?

Whaling is a common type of phishing attack that attempts to draw sensitive information from a user online. Unlike traditional phishing attempts, whaling targets well-known, wealthy, and high-profile individuals (for example, celebrities, executives, or CEOs). The goal of these attacks is to siphon additional confidential information or personal details from the victim.

Whaling is a form of business email compromise (commonly called BEC). It’s a type of social engineering attack, deceiving people into disclosing confidential information. For example, a criminal might pretend to be the CEO of a company you work in and ask for money or sensitive information.

Breakdown of the Whaling Phishing Attack

The first step in any whaling attack is research. These attackers want to come across as authentic, learning everything they can about the corporation, work environment, and standard communication. Criminals will check social networking profiles to gain insights into the company, storing them for future use (increasing credibility with the reader).

From there, attackers will create an authentic-sounding email; logos, letterhead, or links to a fraudulent website are often included to increase the legitimacy of the correspondence.

Content of Whaling Attacks

Most communication with the victim comes across as urgent, with strict deadlines. People are encouraged to reply with specific details, pay invoices, open attachments, or confirm account details on the fraudulent website.

The End Purpose of Whaling Attacks

Attackers typically enter the company network with the information provided by victims, installing malware or software (giving access to the company network or monitoring of communications), or stealing data. This information is then used to extort funds or details from higher authorities within the company.

Common Whaling Attack Methods

Whaling Emails from Colleagues

Arguably the most basic tactic, attackers try to manipulate employees using a spoofed or compromised email address. The tactic often includes a convincing request from a higher, more senior executive to a junior team member.

Social networks are a goldmine of information for social engineering, but the less formal appearance encourages communication among users. While these platforms are ideal for recruiting employees and developing contacts, hackers target these websites for easy company attacks.

Whaling Emails and Confirmation Phone Calls

Potentially one of the most dangerous whaling tactics, this method of cyber attack incorporates two other elements, vishing and supply chain. Cybercriminals use accessible information from suppliers to construct viable-looking emails (including logos, social media accounts, or fabricated websites). Hackers subsequently call their victims after the email to confirm the request. This contact has the victim forgetting the fake email, as it is direct, “real world” communication with the sender.

Real-Life Examples of Whaling Attacks

Seagate Case

In 2016, attackers leaked the personal information of approximately 10,000 former and current employees of Seagate. Unfortunately, the data of these records got into the wrong hands, which put owners at risk of identity fraud. The vast number of records lead to a malpractice lawsuit. Additional accusations came forward, accusing poor handling of sensitive data and lack of surveillance.

Snapchat Case

Several years ago, Snapchat HR staff received a request from chief executive Even Spiegel, asking for payroll information of several former and current employees. An employee answered the email request and submitted the requested details.

Understanding the Consequences of Whaling Attacks

Financial Loss

One of the apparent implications of whaling attacks is the significant amount of money cybercriminals can generate from these attacks. On top of direct financial loss, companies also stand to lose additional amounts in fines for data breaches and probable customer loss.

Data Loss

Cybercriminals are trying to obtain data from whaling attacks; this sensitive information equals significant data breaches, adding up to considerable fines.

Brand Damage

Unfortunately, whaling attacks showcase vulnerabilities in the company. Consumers are less likely to trust corporations that fall victim to such attacks. As a result, future opportunities are likely lost.

Disruption of Services

The consequences of an attack are severe; shifting focus to mitigate damages is critical. The company notifies impacted parties of the data breach, implements additional security measures, and often attempts to recover any lost funds.

Preventing Whaling Attacks

The implications of whaling attacks are severe and potentially devastating to everyone involved. As no one wants to spend their time trying to resolve an attack, here’s what you can do to avoid one while keeping your company safe:

Continually Educate Employees on Cyberattacks

Virtually every employee needs to understand different attacks. Education includes comprehensive information about the signs of an attack, avoiding it, and what to do if they believe a suspicious email arrives in their inbox. A preventative mindset is the easiest method of keeping criminals away from your information.

Social media platforms are a goldmine for cybercriminals wanting to gain inside information. Talk to staff about maintaining private profiles on social media with multi-factor authentication. Ensure that every friend request is someone you know personally, and keep professional details off personal pages.

Always Flag External Emails

Identifying potentially problematic emails is more manageable when all emails outside the company network are flagged. The careful review process brings verification to every email into the company without falling victim to legitimate sounding emails. If an email sounds suspicious, reach out to the sender directly through phone or face-to-face to ensure its contents and request. If the identified sender did not send the correspondence, report the email to superiors or the security department immediately.

Enable Proper Security Measures

A high-quality antivirus, firewall, and email security program are integral for businesses. Make sure that your email security prevents ransomware and phishing attempts. Look for server-based email protection, scanning all emails as they enter the server.

Create an Incident Response and Reporting Plan

Having a plan for cyber-attacks brings a comprehensive approach to cyber-attacks. It’s crucial to outline and maintain a plan, including specific roles and responsibilities. Additionally, the plan should outline communication and response procedures in the event of an attack. Having the framework in place is necessary for optimal protection, giving the steps needed for incidents that would potentially unfold.

Conclusion: Neutralize All Whaling Attacks

Whaling attacks are a dangerous threat to businesses of all sizes but can be avoided with proper education and prevention. Ensure all staff is familiar with various online attacks, including phishing attempts. Set up preventative measures before an attack while establishing the correct parameters for reporting potential threats. Having multiple steps and procedures to handle these threats can keep staff and employees safe without compromising sensitive information. Ensure that your company has proper protections in place to monitor any company emails or correspondence and encourage all staff to report requests for information to superiors. While these tips may not prevent all whaling attempts, failing to safeguard accounts and confidential data can leave your business vulnerable to irreversible damage.