Framework Computer has disclosed a data breach resulting from a phishing attack on its accounting service provider, Keating Consulting Group, exposing the personal information of an unspecified number of customers. The breach occurred when a Keating Consulting accountant fell victim to a threat actor impersonating Framework’s CEO, sharing a spreadsheet with customers’ personally identifiable information (PII) related to outstanding balances. The compromised data includes customer names, email addresses, and balances owed, posing phishing risks for affected customers. Framework promptly notified Keating Consulting’s leadership, initiated an investigation, and identified affected customers, urging vigilance and caution against potential phishing attacks.
The phishing attack unfolded on January 11th when the Keating Consulting accountant responded to an email impersonating Framework’s CEO, providing sensitive information. Framework took swift action, notifying Keating Consulting’s leadership within 29 minutes of the accountant’s response. The company conducted a comprehensive investigation, identifying the exposed customers and promptly informing them of the incident via email. The compromised data raises concerns about phishing threats, as the exposed information could be leveraged for malicious activities, prompting Framework to emphasize legitimate communication channels and advise customers to report suspicious emails to their support team.
In response to the breach, Framework is enhancing security measures, mandating phishing and social engineering attack training for Keating Consulting employees with access to customer information. The company is also conducting audits of standard operating procedures around information requests and reviewing the training procedures of all accounting and finance consultants with access to customer information. While the exact number of affected customers remains undisclosed, Framework’s proactive approach in addressing the breach and implementing additional security measures reflects a commitment to safeguarding customer data and mitigating the potential risks arising from the phishing incident.
