Discovering you are the victim of a data breach is frustrating enough, but it can be even more discouraging to find out the incident occurred due to human error from someone else.

You can do all the steps necessary to protect your data, ranging from enacting dual factor authentication to creating a strong password, but if an employee working for a company that houses your information falls for a phishing scam, for example, your information may still end up in the wrong hands.

Still, you can take all the steps necessary to minimize your risk even after a breach takes place. It’s still important to highlight how cybercriminals will not only target you, but they will also seek the entities that house your valuable data.

In this week’s Thursday Threat Update, we’ll look at a data breach where an employee fell for a particular phishing scheme and a new tactic cybercriminals have deployed to steal cryptocurrency users’ login credentials and funds.

Twilio discloses data breach following “smishing” attack

What we know: Communications company Twilio announced it experienced a data breach after employees fell victim to a SMS phishing scam, which is commonly known as “smishing.” Twilio employees received malicious text messages telling them that their passwords were about to expire. Once they clicked on the link, they were directed to a fake page where they were asked to enter in their login credentials. Cybercriminals were able to take the employees’ credentials and log into Twilio’s system, where they were able to access customer information.

Recommendations: Twilio has started to notify those whose information may have been compromised in the breach, and added that their investigation is in the early stages. The company has not revealed publicly what information may have been exposed. If you are a Twilio customer, keep an eye out for any suspicious messages and consider resetting your passwords. If it’s discovered that additional sensitive information was compromised, you may want to place a credit freeze and fraud alert on your accounts. Additionally, never click on links in texts from senders you don’t know. No reputable organization will ever ask for your login credentials or money, so if you receive a text asking for those items, block and report the sender.

Scammers find success with dual factor crypto phishing scheme

What we know: Cybercriminals have been deploying a phishing scheme aimed at cryptocurrency users. Targets are sent a phishing email designed to look similar to a legitimate Coinbase page. They are asked to enter in their login credentials, which are delivered to the scammer, who will then login to the Coinbase website. This will result in Coinbase sending a dual factor code to the target, who will then enter it into the fake website as prompted. The cybercriminal will then be able to access and transfer funds into an account in their control.

Recommendations: It’s important to remember that no reputable organization will ever ask you for your login credentials. If you receive an email or text message asking you to login, and a link is provided, do not engage with it. It is a scam. It’s also wise to look out for other phishing red flags, including messages that convey a sense of urgency, are filled with misspellings and poor grammar, and are from a sender that you do not recognize.

Stay sharp to stay safe

Cybercriminals are going to continue to try to steal your personal information, which is why it’s important to do whatever you can to minimize your risk. A good place to start is through education: Learn why spam emails are a threat, and ways you can reduce your risk of becoming a victim of data breaches, identity theft and financial fraud.