Shadow PC's breach.

Cloud-based gaming company Shadow has confirmed a data breach in which attackers were able to obtain customers’ “full names, email addresses, dates of birth, billing addresses and credit card expiry dates,” TechCrunch reports.

Shadow attributes the incident to social engineering.

Shadow CEO Eric Sèle said in an email, “At the end of September, we were the victim of a social engineering attack targeting one of our employees. This highly sophisticated attack began on the Discord platform with the downloading of malware under cover of a game on the Steam platform, proposed by an acquaintance of our employee, himself a victim of the same attack.”

An individual who has claimed responsibility for the attack is selling the data on an underground forum, alleging that the database contains the information of more than 530,000 Shadow customers.

Industry grapples with generative AI in social engineering.

Emily Phelps, Director at Cyware, sees the incident as another case of the offensive-defensive seesaw in action. “While advanced security solutions are imperative for safeguarding digital assets, human-centric training is also crucial to address social engineering attacks,” she wrote in emailed comments. “All organizations, regardless of their sector or size, should invest in continuous cyber-awareness training across the organization. This incident serves as a reminder that even the most sophisticated technology platforms are not immune to the age-old tactics of manipulation and exploitation.”

Artificial intelligence (AI) has tipped the balance in cases like this toward the attacker. Steve Povolny, Director of Security Research at Exabeam, commented:  

“Generative AI has elevated the game for threat actors looking to conduct social engineering attacks. The technology enables adversaries to develop extremely convincing phishing emails so that even the most security-aware employee may be fooled. Because the CEO of Shadow confirmed that the company was targeted in a ‘very sophisticated’ social engineering attack, it’s very possible that the malicious actors used generative AI in some capacity.  

“One of the best defenses against AI-powered social engineering attacks is knowledge. Teach employees the signs of suspicious emails, encourage them to call and verify requests, and conduct internal phishing simulations to model attacks.

“In addition, use solutions that can identify any anomalous behavior on a network if an employee makes a mistake and accidentally clicks on a malicious link.”