Extortion by Email

We are seeing another increase in criminals attempting to profit from users of the UCL email system. This particular attack relies on social engineering rather than a technical approach or, to be more blunt, extortion. The criminal emails you and says they hacked your system. They have copies of all your files, your browser history or even photographs or video taken using your webcam.

How the attack works

The criminal might share some information to prove they have accessed your system, a common example is the login details for a site you have visited previously. The attacker tells you they have installed malware on your computer and the only way to prevent them trashing your computer and publishing all the stolen information is to pay a ransom, usually in bitcoins.
Of course criminals lie, so it is very unlikely they have hacked you at all. Much more likely is that there has been a data breach which disclosed the username and password you use at a particular website.

The criminal hopes that by sharing this small amount of information with you, they can trick you into thinking they have much more of your information and get you to pay the ransom.
Similar emails will have been sent to hundreds or thousands of other people and even if only 1% of the people who receive the email pay up it is still very profitable for the criminal.

What should you do?

So what should you do? Firstly never pay a ransom, this only makes it more likely you will be targeted again and again. Secondly if they have sent you login details for a site then change it immediately and if you have reused that password in multiple places change it in all of them. Thirdly move on with your life as the risk they have actually got access to your data, when they make a threat like this, is so small you are more likely to be struck by lightning.