Breach at Docu Sign Led to Targeted Email Malware Campaign
Summary: DocuSign confirmed that a malicious third party gained temporary access to a separate, non-core system used to send service-related email announcements, and used the stolen customer and user email addresses to send malware phishing messages. The May 9 campaign carried the subject line "Completed: docusign.com – Wire Transfer Instructions for recipient-name Document Ready for Signature" and linked to a downloadable Microsoft Word document containing malware; DocuSign said only email addresses were accessed, with no names, passwords, payment data, or eSignature documents affected.
What's compelling: DocuSign says it has more than 100 million users, and the stolen list lets attackers aim malware at people who are already conditioned to click links in DocuSign emails - including users mid-transaction who are actively expecting a document.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026