Yandex Cloud warns of phishing attempts amid data-center disruptions
In short
Yandex Cloud warned that fraudsters could impersonate the platform amid disruptions involving Yandex data centers. It said messages about account recovery, downtime compensation or urgent migration could be used to obtain confidential information or persuade users to open malicious attachments.
Read the full story 1 min read
Yandex Cloud warned of possible phishing attempts made in its name amid the situation involving Yandex data centers, according to reports published on October 12. The platform said fraudsters could use messages about supposedly damaged data, accounts blocked because of a disruption, compensation for downtime or an urgent migration to persuade users to disclose confidential information or open malicious attachments. [ 3 , 4 ]
The company advised users to check the sender's domain, watch for artificially created urgency and treat attachments with caution. It said it never asks by email for passwords, two-factor authentication codes, API keys, bank-card details or remote access to devices. Kommersant reported that the sender's address should use the @yandex.cloud domain and that users were advised to avoid suspicious links and attachments. [ 3 , 5 ]
RIA Novosti reported that users who had already entered their information should change their password, end all sessions, check email-forwarding rules and contact support through the console. The agency also reported that the platform's limited operating mode could restrict the creation of new resources in its cloud infrastructure. [ 4 ]
Yandex Cloud said resources that had become inaccessible would not be billed and no charges would be made for them, according to RIA Novosti. The company also said it had temporarily suspended balance top-ups and that existing customers' resources would not be stopped when their balance reached zero. [ 4 ]
The reports differed in how they described the phishing activity. Vedomosti described possible attempts, while Kommersant reported that fraudsters had become more active in sending phishing emails amid data-center problems. RBC reported that analysts at Smart Business Alert had detected initial signs of fraud schemes and warned that attacks on Yandex data centers could be exploited to steal users' money and accounts. [ 2 , 3 , 5 ]
Why it matters
The warnings concern attempts to obtain access to users' accounts and payment information during service disruptions. Yandex Cloud said it never requests passwords, two-factor authentication codes, API keys, bank-card details or remote device access by email.
Key facts
- Yandex Cloud warned of possible fraud attempts made in its name amid the situation involving Yandex data centers. [ 1 , 3 , 4 , 5 ]
- Possible pretexts include damaged data, blocked accounts, compensation for downtime and urgent migration. [ 3 , 4 , 5 ]
- The platform said it never requests passwords, two-factor authentication codes, API keys, bank-card details or remote device access by email. [ 3 , 5 ]
- Yandex Cloud advised users to check sender domains and be cautious about urgency and attachments. [ 3 , 4 , 5 ]
- RIA Novosti reported that inaccessible cloud resources would not be billed. [ 4 ]
Confirmed by several sources
- Yandex Cloud warned of phishing or fraud attempts amid data-center problems and service disruptions. [ 1 , 3 , 4 , 5 ]
- Fraudulent messages could offer downtime compensation or claim an account was blocked because of a disruption. [ 3 , 4 , 5 ]
- Yandex Cloud said it never requests passwords, bank-card details or remote access by email. [ 3 , 4 , 5 ]
- Users were advised to check sender domains and be cautious about urgency and attachments. [ 3 , 4 , 5 ]
Still unclear
- The scale of the phishing activity and any resulting losses. Kommersant reports increased phishing activity and RBC reports initial signs of schemes, but the documents give no totals for victims or losses.