The Microsoft IT Outage that impacted services worldwide on Friday was caused by a software update by third-party cybersecurity technology company CrowdStrike.
According to Microsoft, the outage—which continues to cause disruption—affected 8.5 million Windows devices. Though they note that this is less than one percent of all Windows machines, the outage crashed systems worldwide, with online banking portals and air travel among the services impacted.
[time-brightcove not-tgx=”true”]The outage was not caused by a cyberattack, but concern has since grown from both CrowdStrike and government-affiliated agencies as to how scammers are capitalizing on the outage and the resulting confusion surrounding malicious cyber activity.
America’s Cyber Defense Agency, the U.K.’s National Cyber Security Centre, and Australia’s National Anti-Scam Centre are among the organizations to issue warnings for consumers to be wary of scams at this time.
Read More: CrowdStrike’s Role In the Microsoft IT Outage, Explained
According to CrowdStrike’s blog, a “likely eCrime actor is using file names capitalizing on July 19, 2024,” specifically utilizing a malicious ZIP archive named “crowdstrike-hotfix.zip” to take data from customers.
Here is how you can protect yourself from scammers as disruptions from the outage continue to unfold.
You’ve already begun this first step. Be aware of phishing scams that have cropped up to capitalize on the CrowdStrike outage and do not download zip-files or software from unknown sources claiming to help with the outage.
When receiving requests for personal information by unknown numbers, be aware, and never share sensitive information to unverified sources.
The U.K’s National Cyber Security Centre has a robust guidance sheet for how organizations and businesses can protect their employees from phishing. This guidance includes four layers of mitigation tactics, from employing anti-spoofing controls to ensuring employees are aware of what phishing looks like and the tactics used to trick users into handing over information or making unauthorized payments.
David Brumley, professor of electrical and computer engineering at Carnegie Mellon University, tells TIME he has seen a few different kinds of scam tactics over the weekend. The most prominent of these include malicious actors pretending to be CrowdStrike, offering to help businesses after the outage. He’s also noticed scammers pretending to be airlines and other organizations, again pretending to offer help to those impacted. The best course of action, Brumley notes, is always to contact business representatives directly.
“If you get a text that purports to be from one of [these businesses] and you feel uncomfortable, always just call them directly,” Brumley says.
CrowdStrike has its own “Remediation and Guidance Hub” on its blog to help those affected, and Microsoft also has its own support page.
Be sure to contact these companies via their official pages and help desks, rather than by responding to texts or emails claiming to be sent from the companies or affiliated parties.
According to Catriona Lowe, deputy chair of the Australian Competition & Consumer Commission, these scammers often create “a sense of urgency that you need to do what they say to protect your computer and your financial information.”
The best way to combat this is to slow down and ensure that you are not giving out personal details over text and email, especially to unverified sources.
Different countries have designated websites where you can report scams. In Australia, people can head to Scamwatch for further help. In the U.K., those impacted or concerned can send an email to report@phishing.gov.uk. Meanwhile, in the U.S., people can report instances of fraud via the Federal Trade Commission.
According to the U.S. National Institute of Aging, older adults—defined generally as those above the age of 65—are often the target of scams. When possible, check in with older friends and family to ensure that they have the above tools and are aware of the rise in phishing scams as a result of the outage.
Clare O’Neil, Australia’s Minister for Home Affairs and Minister for Cyber Security, has also pointed out the need to protect those most vulnerable to falling victim to scams. In a series of posts shared on X (formerly Twitter) she said: “It is very important that Australians are extremely cautious of any unexpected texts, calls or emails claiming to be assistance with this issue.” She continued by specifying that people can help by “making sure vulnerable people, including elderly relatives, are being extra cautious at this time.”
