The FBI has issued a warning to US organizations and law enforcement about cybercriminals attempting to harvest personally identifiable information (PII) through fake emergency data requests.
In critical situations, law enforcement agencies can use an emergency data request to access information from online service providers without waiting for a subpoena. The FBI has detected a surge in cybercrime forum activity related to emergency data requests, abused by Lapsus$ and other malicious actors.
As stated in the FBI’s alert, “Cyber-criminals are likely gaining access to compromised US and foreign government email addresses and using them to conduct fraudulent emergency data requests to US based companies, exposing the personal information of customers to further use for criminal purposes.”
The agency stated that in August, a known cybercriminal advertised .gov email addresses, including US credentials, on an online forum, claiming they could be used for espionage, social engineering, extortion, and data requests. The cybercriminal also gave guidance on how to abuse these addresses for emergency data requests and offered real stolen subpoena documents for sale, facilitating other cybercriminals in impersonating law enforcement officers.
In March 2024, the FBI noted that a threat actor claimed on a forum to have government email addresses from 25 countries, which could be used for fake subpoenas to obtain emails, usernames, phone numbers, and other information. That same month, another threat actor bragged on an online forum about sending a fraudulent request to PayPal for confidential information. PayPal recognized it as a fraudulent Mutual Legal Assistance Treaty (MLAT) and denied the request.
In forum posts last year, cybercriminals revealed how .gov emails could be used to send fake emergency data requests to collect information for further attacks. They also sold guides on using these requests to access social media account information. Organizations receiving emergency data requests should maintain close relationships with the FBI, update their incident response and communication plans, and take proactive steps to mitigate risks.
The FBI suggests that organizations enhance their security posture by adopting best practices. These include evaluating the security of third-party vendors, enforcing strong password protocols and multi-factor authentication (MFA), assessing user accounts and domain controllers, implementing time-based access for administrator accounts, limiting and monitoring remote access to internal resources, segmenting networks, and establishing vulnerability management programs.
The FBI noted that, “Cybercriminals understand the need for exigency, and use it to their advantage to shortcut the necessary analysis of the emergency data request. FBI recommends reviewers pay close attention to doctored images such as signatures or logos applied to the document. In addition, FBI recommends looking at the legal codes referenced in the emergency data request, as they should match what would be expected from the originating authority.”
By partnering with Apex Technology Management, organizations can strengthen their defenses against cyber threats and ensure compliance with the FBI’s recommendations.
