05/08/2026
My work email was compromised yesterday morning.
If you received an email from [email protected] today with the subject "Re: New Requirements/ Proposal", do not click the link. Delete it. It did not come from me.
The account is secured and cleaned up. Apologies to everyone who copped one.
Two things worth passing on, because I have spent years telling installers to lock down their systems and I did not check this one on my own account.
The way in was not a guessed password. Someone authorised a third party app on my Google account. Changing your password does not revoke that. The app keeps its token and keeps reading your mail. You have to go into your account security page and remove the connection by hand. Microsoft 365 works the same way.
And the mailbox is rarely the target. Your invoices are. The attacker sits in your sent folder, waits for a real job to land, then emails your client the same invoice with different bank details. So if any supplier emails you asking to update remittance details, ring them on a number you already had. Not the number in the email.
Go and check your third party app access today. Takes two minutes.
Glen
