Cyber Risks · Krebs on Security

Log MeIn, Docu Sign Investigate Breach Claims

Summary: In December 2012, LogMeIn and DocuSign customers reported receiving malware-laced emails to addresses they had created exclusively for those services, with some LogMeIn users flagging the activity on Dec. 3. Both companies said they were investigating but had found no evidence of a breach; LogMeIn spokesman Craig VerColen noted that nearly 30% of reports involved addresses containing variations of LogMeIn in the name, while DocuSign CMO Dustin Grosse attributed the incident to aggressive phishing.

Why it matters: Users who tracked one-use email aliases reported spam only at the specific addresses they gave LogMeIn and DocuSign, and as one Houston realtor noted, leaked LogMeIn credentials could give an attacker full interactive access to any number of computers and mobile devices.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related