Dustin was hacked. The next attack arrives in your inbox.

On Thursday 3 September, Dustin discovered unauthorised access to parts of its internal IT systems. The company shut down its web store and several other systems itself to stop the intrusion. "It is not a technical failure, it is unauthorised access," head of communications Eva Ernfors told EFN.

External security experts were brought in and the incident was reported to the authorities. By 8 September, according to Ehandel.se, Dustin had restarted its order flow, taking orders by phone and email while the website and customer portals were reopened step by step.

In the first updates there was no confirmation that customer data had leaked, but it had not been ruled out either. According to threat intelligence sites, a ransomware group has claimed the attack. That is not confirmed by Dustin, and we draw no conclusions from it.

According to Dustin's first update, as reported by eBuilder Security, initial findings pointed to the attackers having had access to internal support and administration systems. Systems like that typically hold contact people, order history, delivery addresses and support tickets.

That is exactly the material needed to write a convincing phishing email: the right name, the right product, the right order number.

But there is a risk even without leaked data. The news is public. Anyone who wants to trick a Dustin customer now knows you are waiting for news about your order, that the website has been down, and that "please update your details" sounds perfectly reasonable right now. Fraudsters do not need to hack anyone to exploit a headline.

If you take only one thing from this piece, make it this one. It is the advice I am giving everyone I talk to right now. After an incident like this, it is rarely the breach itself that costs a customer money. It is the email that arrives three weeks later, in the middle of a busy day, that nobody had time to look at properly.

Look at the actual address after the @, not the name that is displayed. The display name can say "Dustin Customer Service" no matter who sent it. Watch out in particular for:

• A swapped letter. An l instead of an i, the digit 1 instead of an i, or a doubled letter. You will not see it reading quickly on a phone.
• Extra words with hyphens. Something like "dustin-order", "dustin-support" or "dustin-customer" in front of the domain. A real company does not start sending from a new domain because it had an incident.
• The wrong ending. .com, .net or .co instead of the one you usually see. Dustin's Swedish website is dustin.se.
• The domain hidden further along. An address that starts with "dustin.se" but continues with something else after the next dot belongs to whatever comes last, not what comes first.
• Urgency. "Confirm within 24 hours", "your account is locked", "your order is on hold". Stress is the tool.
• New payment details. An email saying a supplier has changed bank account should never be handled by email. Call a number you already have, not the one in the email.

The simplest test: find an old email from Dustin that you know is genuine and compare the address character by character. And never click the link in the email to log in. Type the address into the browser yourself.

The same goes for any supplier that ends up in the news. Dustin simply happens to be the one in the headlines this month.

The Swedish Police warned earlier this year of a growing number of fraudulent emails targeting companies, with the same basic advice: confirm unusual payment requests through a channel other than email, for example by phone.

• Change your Dustin customer portal password once the portal is back, and anywhere the same password has been used. Turn on two-step verification if it is available.
• Find out who in your company has an account. It is often more people than you think, including people who have left.
• Check integrations. If you have connections to Dustin, for purchasing or licences for example, ask whether keys and logins have been rotated.
• Ask for a written answer. Ask Dustin whether your specific data is in the affected systems. The answer is worth keeping.
• Introduce a payment rule. Changed bank details are never approved by one person alone and never by email only. It costs nothing and stops the most common type of invoice fraud.
• Say it out loud at your next meeting. Whoever pays invoices and whoever orders equipment needs to hear this, not just IT.

This is everyday work in our Managed IT: passwords, two-step verification and routines that are in place before something happens. Received an email you are unsure about? Get in touch and we will look at it together. It takes five minutes and it is free.