--- title: "Cyber Security News Update, Week 39 of 2020 | DuoCircle" description: "Waiting on a package from somewhere? Be careful, it could be a scam called the “waiting package” scam. How original." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-39-of-2020/" --- Quick Answer Cybersecurity headlines for the week of September 25, 2020\. The US FTC warned of a 'waiting package' phishing scam targeting college students with texts claiming a parcel had been waiting since the spring campus closures. An evolved Nigerian advance-fee scam returned with COVID and stimulus-themed pretexts. Researchers reported attackers abusing Google App Engine's appspot.com subdomains to host phishing pages that inherit Google's TLS certificate and trusted reputation. The Australian government disclosed a wave of phishing impersonating Service Australia and the ATO. Universitatsklinikum Dusseldorf in Germany was hit by a ransomware attack that disrupted clinical systems and contributed to the death of a patient diverted to another hospital. The phishing roundup covers other notable lures. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-39-of-2020%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Cyber%20Security%20News%20Update%2C%20Week%2039%20of%202020&url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-39-of-2020%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-39-of-2020%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-39-of-2020%2F&title=Cyber%20Security%20News%20Update%2C%20Week%2039%20of%202020 "Share on Reddit") [ ](mailto:?subject=Cyber%20Security%20News%20Update%2C%20Week%2039%20of%202020&body=Check out this article: undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-39-of-2020%2F "Share via Email") ![Cyber Security](https://media.mailhop.org/duocircle/images/2020/09/dmarc-generator-5735.jpg) Waiting on a package from somewhere? Be careful, _it could be a scam called the “waiting package” scam_. How original. According to the US Federal Trade Commission, “The messages are coming from scammers. In some cases, they’re targeted at college students. In that version, _scammers text returning students to say there’s a package waiting for them_, sometimes claiming it’s been waiting since last spring, when many students had to go home from campus quickly.” **Don’t click** that link. ## Nigerian Scam _You’d think by now every person on the planet would be aware of the Nigerian **email scam** and avoid it like the plague_. After all, it’s been going around in one form or another since 1588 “when it was known as the Spanish Prisoner Scam.” But it’s still circulating so it must still reel in some victims. This week’s Nigerian email scam story comes from [Scamicide](https://scamicide.com/2020/09/21/scam-of-the-day-september-22-2020-another-nigerian-email-scam/). “In the most common versions of this scam circulating on the Internet today, _you are promised great sums of money if you assist a Nigerian or someone elsewhere in his effort to transfer money out of his country_. In most variations of this scam, although you are told initially that you do not need to contribute anything financially to the endeavor, you soon learn that it is necessary for you to contribute continuing large amounts of money for various reasons, such as fees, bribes, insurance or taxes before you can get anything.” Amazing that it still works. [![ransomware](https://media.mailhop.org/duocircle/images/2020/09/check-dmarc-record-3045.jpg)](https://media.mailhop.org/duocircle/images/2020/09/check-dmarc-record-3045.jpg) ## Phishing Phrontier How bad is ransomware in 2020? “_A successful [ransomware](https://www.phishingtackle.com/ransomware/) attack is estimated to hit an organisation **every 11 seconds** globally_, with collective damages set to **hit over £15 billion** by the end of 2020.” _Every 11 seconds!_ “_A striking 25% increase of ransomware attacks was observed since the start of the pandemic_; a kick in the teeth for organisation’s all over the globe that were already on their knees. For many organisation’s, these attacks are simply not recoverable.” We know one group of people not hurt by the pandemic. ## Google App Engine Hack Ever heard of the Google App Engine? Most people haven’t, but do you know who has? _Hackers, and they’re using it to hack you_. [Google App Engine](https://en.wikipedia.org/wiki/Google%5FApp%5FEngine) is a Platform as a Service and cloud computing platform for developing and hosting web applications in Google-managed data centers. According to [Tech and U](https://www.technadu.com/the-google-app-engine-could-be-to-blame-for-stealthy-phishing-attacks/208551/), “Security researcher [Marcel Afrahim](https://medium.com/@marcelx/attackers-are-abusing-googles-app-engine-to-circumvent-enterprise-security-solutions-again-eda8345d531d) has discovered a novel _technique that involves the abuse of Google’s App Engine domains to support the operations of **phishing or malware campaigns** without running the risk of detection_.” That’s a hacker’s favorite thing: sending malware without the risk of detection. Well done. ## Body Count This week’s top award to the government that got taken by a **phishing scam** goes to…Puerto Rico, to the tune of **$2.6 million**. According to [Business Insider](https://www.businessinsider.com/puerto-rico-government-loses-26-million-in-phishing-scam-2020-2), “The finance director of the island’s Industrial Development Company, Rubén Rivera, said in a complaint filed to police Tuesday that the agency sent the money to a fraudulent account. _It’s unclear whether officials have been able to recover any of the money and what impact the financial loss has on the government agency_.” [![phishing protection](https://media.mailhop.org/duocircle/images/2020/09/what-is-a-dmarc-2748.jpg)](https://media.mailhop.org/duocircle/images/2020/09/what-is-a-dmarc-2748.jpg) What is clear is that the island’s Industrial Development Company probably should have invested a few bucks into [phishing protection](/email/phishing-protection) software. ## Australian Government Phishing The runner up award to the government that got taken by a **phishing scam** goes to…Australia, to the tune of _200,000 stolen records_. According to [Before It’s News](https://beforeitsnews.com/business/2020/09/australian-state-government-faces-nearly-200000-customer-record-stolen-in-a-phishing-attack-2-3638211.html), “_The theft of data related to over 186,000 individuals took place in April 2020_. The amount of information totaled over **738 GB of data**. _More than 3.8 million documents were gathered_. These documents included a wide variety of information, like forms, records of transactions, scans, and applications. _More than half a million documents had information that could personally identify the victims_.” Ditto for Australia investing a few bucks in [phishing protection software](/email/phishing-protection). ## Hospital in Germany Hacked Normally in the weekly Body Count we use the term metaphorically to indicate some company that got taken, usually for money or data, in some kind of scam. We don’t normally use Body Count to refer to an actual body. Unfortunately, this week there’s a story from _Germany in which a hack actually resulted in someone dying_. According to an [article](https://www.securityweek.com/german-hospital-hacked-patient-taken-another-city-dies) in Security Week, “German authorities said Thursday that what appears to have been a **misdirected hacker attack** caused the failure of IT systems at a major hospital in Duesseldorf, and a _woman who needed urgent admission died after she had to be taken to another city for treatment_.” RIP. And that’s the week that was. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-39-of-2020%2F) [ ](https://twitter.com/intent/tweet?text=Cyber%20Security%20News%20Update%2C%20Week%2039%20of%202020&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-39-of-2020%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-39-of-2020%2F) Copy Related Articles - [ ![spam](https://media.mailhop.org/duocircle/images/2021/07/sender-policy-framework-7535.jpg) Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam News ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/) - [ ![Spam](https://media.mailhop.org/duocircle/images/2016/05/spf-permerror-3256.jpg) April Spam Filtering Uptime Report News ](/blog/announcements/april-spam-filtering-uptime-report/) - [ ![Spam Filtering](https://media.mailhop.org/duocircle/images/2023/02/spf-record-tester-7226.jpg) Changes to Spam Filtering Technology News ](/blog/announcements/changes-to-spam-filtering-technology/) - [ ![Cyber Security](https://media.mailhop.org/duocircle/images/2020/01/spf-permerror-7312.jpg) Cyber Security News Update, Week 1 of 2020 News ](/blog/announcements/cyber-security-news-update-week-1-of-2020/) ## Related Articles [ News 3m Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam Jul 20, 2021 ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/)[ News 1m April Spam Filtering Uptime Report May 4, 2016 ](/blog/announcements/april-spam-filtering-uptime-report/)[ News 2m Changes to Spam Filtering Technology Feb 8, 2023 ](/blog/announcements/changes-to-spam-filtering-technology/)[ News 4m Cyber Security News Update, Week 1 of 2020 Jan 3, 2020 ](/blog/announcements/cyber-security-news-update-week-1-of-2020/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Cyber Security News Update, Week 39 of 2020","description":"Waiting on a package from somewhere? Be careful, it could be a scam called the “waiting package” scam. How original.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-39-of-2020/","datePublished":"2020-09-25T20:25:40.000Z","dateModified":"2025-05-26T18:17:01.000Z","dateCreated":"2020-09-25T20:25:40.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-39-of-2020/"},"articleSection":"announcements","keywords":"","wordCount":764,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/09/dmarc-generator-5735.jpg","caption":"Cyber Security","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"News"},{"@type":"ListItem","position":3,"name":"Cyber Security News Update, Week 39 of 2020","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-39-of-2020/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"News","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Cyber Security News Update, Week 39 of 2020","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-39-of-2020/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Cyber Security News Update, Week 39 of 2020","description":"Waiting on a package from somewhere? Be careful, it could be a scam called the “waiting package” scam. How original.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-39-of-2020/","datePublished":"2020-09-25T20:25:40.000Z","dateModified":"2025-05-26T18:17:01.000Z","dateCreated":"2020-09-25T20:25:40.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-39-of-2020/"},"articleSection":"announcements","keywords":"","wordCount":764,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/09/dmarc-generator-5735.jpg","caption":"Cyber Security","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```