Phish Leads to Breach at Calif. State Controller
Summary: A phishing attack gave intruders access to the email records of an employee in the California State Controller's Office Unclaimed Property Division for more than 24 hours starting the afternoon of March 18, after the employee clicked a phishing link and entered their email ID and password. The SCO said no state employee data was compromised and that its logs showed no access to Office 365 files beyond the employee's mailbox, while an anonymous source in an adjacent state agency said the intruders stole documents with personal and financial data on thousands of state employees and sent targeted phishing emails to at least 9,000 California state workers and their contacts.
Key Takeaway: The agency handles more than $100 billion in public funds each year, and a single clicked link and entered password bought the intruders over 24 hours inside an account whose inbox was then used to phish at least 9,000 state workers and their contacts.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026