Capita hack - phishing attempt?

jadedfuture

Hello everyone,

Today I received an email from soprasteria@email.cescommunications.co.uk with the subject line The Capita Cyber Incident. What is it? When did it happen? How does it affect me? addressed to "Dear Member"

"We would like to share a letter from the Trustee, along with a Frequently Asked Questions (FAQ) document, providing responses to some of the questions that members have asked the Trustee, and providing further guidance on actions that you should consider taking. - You can view this by clicking on the link below."

The link is to email.cescommunications.co.uk/_act/link.php?mId=with a long string of numbers.

No idea who cescommunications.co.uk is so I spoke to Steria and they say this is not from them, and suggested I reported it as phishing.

Be careful everyone.

G.

jadedfuture

Just to follow up and save anyone else the temptation - I went to cescommunications.co.uk, the site is not secure - and although it has some Capita graphics - says "This site is underdevelopment"

G.

p00hsticks

jadedfuture said:

No idea who cescommunications.co.uk is so I spoke to Steria and they say this is not from them, and suggested I reported it as phishing.

Not sure who you spoke to in Steria but looking back over old e-mails I can see several presumably legitimate e-mails  from Steria pre-dating the Capita hack, (e.g. one in August last year with a Pension newsletter) coming from that e-mail address 

soprasteria@email.cescommunications.co.uk

so I think it may possibly be a case of the employee you spoke to not knowing how Steria's bulk e-mailing is carried out than it actually being a phishing attempt. 

p00hsticks

jadedfuture said:

Just to follow up and save anyone else the temptation - I went to cescommunications.co.uk, the site is not secure - and although it has some Capita graphics - says "This site is underdevelopment"

Try looking at email.cescommunications.co.uk and you will see it explains it is the root domain of a link used by a brand using the Pure360 company to e-mail it;s marketing material

jadedfuture

Sorry - anyone could set that up - "Rest assured - all is in order"
not secure - and unable to copy text - I suspect it is legitimate - but shoddy at best.