NYC mayor limits access to employee payroll website after ‘smishing’ campaign
New York City’s cybersecurity team last month discovered a text-message phishing campaign targeting city employees, in which hackers attempted to steal users’ personal information to access the city’s payroll system.
In response to the cyber incident and to safeguard employees’ personal and financial information, Mayor Eric Adams’ administration has taken the website partially offline for more than a week, Politico reported on Tuesday.
Text message, or SMS, phishing is a social engineering technique in which cybercriminals send text messages containing links to malicious websites, according to the New York Office of Technology and Innovation, which referred to the incident as “smishing,” a portmanteau of “SMS” and “phishing.”
“NYC Cyber Command was made aware of a smishing campaign targeting NYCAPS users,” the Office of Technology and Innovation said in a statement emailed to StateScoop. “City employees have been advised to remain vigilant and confirm the legitimacy of any NYCAPS and payroll-related communications and activity.”
Employees received fraudulent text messages directing them to activate multi-factor authentication for the payroll system, in an effort to obtain usernames, passwords and, in some cases, photos of their driver’s licenses.
The link in the text message led workers to “a phishing scam domain out of Lithuania,” according to Naveed Hasan, a technology consultant and member of the New York City’s Panel for Education Policy, who posted about the incident last week.
The payroll system, called New York City Automated Personnel System, Employee Self Service, or NYCAPS/ESS, is currently only accessible via New York City’s intranet, a private city network, leaving roughly 300,000 full-time New York City employees with limited access to the website and essential tax documents ahead of the tax-filing deadline on April 15.
