The wildfires in Los Angeles and surrounding areas have left residents and businesses vulnerable to exploitation by scammers looking to take advantage of them for financial gain, to steal their identities, and other fraudulent activities. Here’s a few examples from the news that illustrate what I am talking about.
Jim Routh, Chief Trust Officer at cybersecurity company Saviynt, commented:
“Enterprises with geo-location settings used for authentication validation purposes should adjust their models to acknowledge those employees forced to evacuate their home.
“Major catastrophic events like the fires in California bring out kindness and empathy from many people who are not victims for days following the event. Unfortunately, these events also bring out cyber criminals seeking to capitalize on the victim’s misfortune by designing phishing emails supposedly from FEMA, fire officials or other state and local agencies offering relief options. We recommend:
1. Review your passwords for key accounts/sites and consider improving the complexity of the password (use a password manager and ensure that you have access to it from all devices)
2. Read email messages closely and identify the origin of the sender’s email address
3. Avoid clicking on links in email messages unless you are certain of the validity of the sender
4. Print a list of emergency numbers to keep handy and include the FEMA Fraud Hotline:
1. To protect yourself from fraud and identity theft, we encourage you to be careful when sharing your personal information.
If you believe you are a victim of identity theft, or someone applied to FEMA using your personal information, please call 800-621-3362. Do not contact the FEMA Fraud Investigations and Inspections Division, DHS Office of Inspector General, or the National Center for Disaster Fraud for the purpose of reporting identity theft.
Report any other types of disaster fraud by emailing StopFEMAFraud@fema.dhs.gov. For more information, visit the disaster fraud page.
5. Employees and third parties will be forced to access networks from different locations using potentially different devices. Increase staffing levels of IAM ops staff to address the needs of storm victims and expand call coverage
6. Advise employees to consider donations to the American Red Cross and other disaster relief organizations that are well established vs. newly formed entities specific to the California fires.”
James McQuiggan, security awareness advocate at cybersecurity company KnowBe4:
“The fires in Los Angeles County have caused significant loss of homes and property, leaving many residents vulnerable to exploitation. Scammers often prey on homeowners facing challenges with their insurance providers, posing as fake adjusters, offering fraudulent services, or ways to get money fast to start rebuilding. These schemes often involve promises of quick resolutions in exchange for upfront payments or steep fees. Some may claim they can prevent insurers from dropping coverage, adding to the stress of an already difficult situation.
“Homeowners should confirm the identity of any insurance representative by contacting their provider directly and avoid making hasty decisions or signing agreements without proper verification. Outside of LA, individuals moved by the destruction will be targeted by fake donation campaigns or fraudulent grassroots donation platforms. Scammers create convincing appeals, often using AI-generated synthetic images to portray fabricated victims or destroyed homes. These scams manipulate people’s emotions and ask for donations quickly.
“People looking to help should prioritize verified charities with established reputations and avoid sharing financial information through requests or unverified crowdfunding campaigns. Careful research and communication with the proper and recognized organizations can ensure that contributions are used for legitimate relief efforts.
“Disaster-related scams are not new and have appeared after hurricanes, floods, and earthquakes, following a similar pattern of urgency and emotional manipulation. The tactics remain consistent: leveraging heightened emotions and telling stories to exploit our human nature. It’s essential to remain cautious and somewhat skeptical during such events. Taking the time to verify claims, conducting research, and educating others can significantly reduce the effectiveness of these schemes. Awareness is critical to prevent fraud from happening based on the devastation of these events and ensure that support reaches those who need it most during their time of need.”
So the question becomes how can you help and not get scammed. Here’s a list that I’ve complied:
California Community Foundation
California Fire Foundation
L.A. Fire Department Foundation
Pasadena Humane Society
Ventura County Community Foundation
American Red Cross of Greater Los Angeles
Center for Disaster Philanthropy
Direct Relief
World Central Kitchen
Any assistance to any of these organizations is appreciated.
UK considers ban on public sector ransomware payments
Posted in Commentary with tags UK on January 15, 2025 by itnerdOn Tuesday, the UK government published a Home Office-led consultation proposing a ban on the public sector and critical infrastructure organizations making ransomware payments with the hope of disrupting ransomware gangs’ financial models and gather intelligence to help law enforcement target their operations.
The Home Office said that expanding an existing ban on ransomware payments would help make critical services such as hospitals, schools, railways, and other essential public services less attractive targets for ransomware attacks.
In addition to the ban, ransomware incident mandatory reporting has also been proposed aiming to boost UK law enforcement agencies’ access to intelligence on attacks and support international law enforcement operations targeting ransomware gangs.
“With an estimated $1bn flowing to ransomware criminals globally in 2023, it is vital we act to protect national security as a key foundation upon which this Government’s Plan for Change is built.
“These proposals help us meet the scale of the ransomware threat, hitting these criminal networks in their wallets and cutting off the key financial pipeline they rely upon to operate,” UK Security Minister, Dan Jarvis, commented.
Furthermore, the consultation will explore the implementation of ransomware payment prevention regime, offering victims guidance on how to respond to cyber incidents. It would also help block payments to known criminal groups and sanctioned entities.
The consultation will run for 12 weeks, ending on April 8.
Evan Dornbush, former NSA cybersecurity expert had this to say:
“Something needs to change. The economics of cybercrime favor the aggressor. Until solutions can effect an increase in attackers’ costs and/or a decrease in attackers’ revenues, there is nothing to suggest the increasing rates of attack will diminish.”
I have said for a while that nobody should ever pay a threat actor who is holding their data hostage or is threatening to leak their data. Or perhaps both. It emboldens them to do more of this which is bad for all of us. This is a start, but more needs to be done to make sure that crime doesn’t pay.
UPDATE: Lawrence Pingree, VP, Dispersive adds this:
“The benefit of this approach is that the reward for doing the ransom goes away. Australia did a similar mandate. I think it will likely have a positive effect on larger entities where the targeting often happens.”
Leave a comment »