Voice phishing is how SaaS data leaves now
This month’s breaches at Crunchyroll and Aura reportedly started with phone calls and phished support staff. Your help desk and vendors are the target.
Two breaches reported this month follow the same pattern. At Crunchyroll, an attacker reportedly phished an agent at an outsourced support provider who had single sign-on access to internal tools, and downloaded millions of support tickets. At Aura, an identity protection company, a voice phishing call to an employee led to access to about 900,000 records.
No exploit, no malware. A convincing call, an MFA prompt approved, and a SaaS export button.
- Use phishing-resistant MFA, passkeys or security keys, for staff and contractors with access to customer data. Push approvals and SMS codes can be talked out of people.
- Limit what support agents can see and export. Most don’t need bulk downloads.
- Alert on large exports from your CRM and support tools.
- Tell staff plainly: IT will never call and ask you to approve a login.