Situation — Attack, leak or dispute

An employee entered their password on a fake login page: the hackers got into our online tools and stole our data.

Context

An employee got a call from "IT support". They were sent a link, they logged in, they gave their code. Everything seemed normal.

A few days later, a message arrives: your client data has been copied, and the hackers are demanding a ransom.

The problem

  • With a real password, the hacker passes as an employee. No alarm goes off.
  • A two-factor authentication code given over the phone no longer protects you.
  • Client data copied, ransom, threat of publication: it all hits at once.

Case study

Real-life casefirst half of 2025

Worldwide fake IT support campaign (UNC6040)

In the first half of 2025, Google observed a worldwide campaign. Fake IT support technicians called employees. They sent them to a fake login page, or asked for their credentials and two-factor authentication codes.

They then got employees to approve a fake application connected to Salesforce, the customer relationship management tool. They extracted entire tables of client data, then demanded a bitcoin ransom within 72 hours. Salesforce itself had no flaw: only the employees were fooled.

In France, in early 2024, attackers used manipulation to take over the accounts of Cap emploi advisers, partners of the public employment service France Travail. In January 2026, the CNIL (French data protection authority) fined France Travail 5 million euros, in particular for weak authentication (CNIL (opens in a new tab)).

Read the sourceThe Cost of a Call: From Voice Phishing to Data Extortion — Google Threat Intelligence Group (Google Cloud blog) (opens in a new tab)

Why us?

  • We cut off the stolen access and remove the applications the hackers added.
  • We analyse your tools' logs to establish what was viewed and copied.
  • We keep the evidence and prepare your notification to the CNIL if personal data is affected.
  • Attack in progress? Email contact@orbitalmz.com with the subject "Attack in progress": these messages are read first.

Contact us

Talk to an expert

A free 30-minute video call with one of our experts, then your free quote, with no commitment.

Take the diagnostic

A few questions, the first already answered for your situation: your answers help us prepare the video call. Free, no sign-up, about 2 minutes.

Take the diagnostic