It does make you wonder when there’s going to be a 4th, I certainly don’t think I’d want my customers contact details in their system at the moment.
It's not. Multiple marketing automation/email service provider platforms were affected by similar hacks last year.
You have to understand the sort of mythical place the company had in the nascent Atlanta tech scene. It was one of the first Atlanta tech unicorns and was growing and hiring at a rapid clip. The founders promised never to sell and that they would give annual bonuses in exchange for not offering employee equity. The office was brimming with art, music, and perks that were unusual for Atlanta at the time. They said they were going to build a generational Atlanta tech company.
I desperately tried to recruit my friends that worked at Mailchimp away, because I saw the writing on the wall. I had joined a promising startup offering significant equity, and more importantly, building real value in the world. To my disappointment, none of my Mailchimp friends joined me. They liked the culture too much, felt comfortable, and continued to tout the bonuses they were receiving despite Mailchimp offering lower total comp. I never stopped trying to pull them away, but I didn't succeed. I received counter offers and heard the Kool Aid stories. "The founders are so cool and so generous."
The job itself isn't that interesting, either. Marketing and email advertising isn't intellectually attractive. To top it off, Mailchimp has a disgusting PHP monolith that I've heard is like pulling teeth to work with.
I was right in the end. I walked away with a huge eight figure exit. Mailchimp employees got pay cuts, benefit cuts, and saw their culture ravaged. Intuit took what little niceties they had and threw it all to the wind. Macy's and Home Depot have better software jobs.
I really don't like Mailchimp. The company is rotten.
And you thought a company whose raison d'être was email marketing was going to be a “generational company”?
I worked in Atlanta until late last year.
Employees get really good at spotting the tests.
It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests.
I actually found KnowBe4 to work fairly well on a large scale.
It used to be that if a mailbox got compromised they would just send spam about lottery wins and boner pills. Now they watch your messages and reply to a real request with a good looking response. A correct expected reply in a chain from an authentic account, just some numbers have changed. Then they will steal your contacts and register a similar domain and try to impersonate you.
Ooof, that'd be a tough one not to fall for.
Then surely either the test isn't good enough, or the problem is solved?
They have a similar concept in cybersecurity.
The Red Team
> a group that plays the role of an enemy or competitor to provide security feedback from that perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military and intelligence agencies.
With crap like that it isn't all that strange that some of these attempts get through and on the social engineering side it can't be all that much better. After all we're continuously conditioned to trust that which we really shouldn't be trusting. Right up to the point where the party on the other side is abusing that trust.
One example: my real bank calling me and then asking me to verify that it is really me by asking me all kinds of information about my account... And from a number that isn't associated with them. And yet, it was very real and when I refused to answer their questions they took it pretty badly as though I was a scammer...