Erik Wemple at the Opinion section of the Washington Post reported that “There are few places in contemporary media where the dangling of a phony bonus would receive a worse reception than at Tribune Publishing. Employees of the newspaper colossus — which owns the Chicago Tribune, the Orlando Sentinel, the New York Daily News, the Capital Gazette and the Maryland Gazette — have been subjected to furloughs, pay cuts and, in several cases, the closure of their shared workspaces.”
He continued: ” All of which provides context for the email that Tribune Publishing employees received on Wednesday. “Congradulations Executives!!” started the email — and yes, the typo is in the original. It explained that the company is “pleased to inform you that we are providing targeted bonuses between 5,000 and 10,000 dollars this year. Tribune Publishing is able to provide this bonus as a direct result of the success created by the ongoing efforts to cut our costs!” The email then instructs employees to “login” to “view your end of year bonuses.”
On Twitter, the comments were that the test came across as disrespectful, a slap in the face and tone-deaf. That reaction is understandable. Simulated phishing tests need to be sensitive to the existing corporate culture and circumstances.
“Today the company conducted a regular, internal test to assess and reduce its current phishing and malware risk level. Based on input provided by the company’s cybersecurity team and advisers, the content of that test included language regarding employee bonuses. Having fallen victim to attacks of this nature before, the company recognized that bad actors use this type of language regularly, and decided to use the language to simulate common phishing scams.
The company had no intention of offending any of its employees. In retrospect, the topic of the email was misleading and insensitive, and the company apologizes for its use.”
We even have an automated campaign where we take real phishing attacks that came in from the bad guys, “defang” them, and provide those as templates. If there is any doubt, we recommend running a small pilot of the campaign and test it before sending it to the full employee list.
Tribune Publishing apologizes for fake bonus offer in phishing-simulation email fe-dumpssu, n1shopsu