2026年10月10日の
セキュリティ情報

Subject: [Security Alert] Beware of Fraudulent Phone Calls and Social Engineering

Dear employees,

We would like to alert you to a recent trend where attackers use phone calls and social engineering—rather than technical malware—to extort money by claiming to have sensitive information.

What we need from you:
1. Be cautious of unsolicited phone calls, emails, or social media messages from unknown sources.
2. If you receive any threatening communication claiming that your or the company's data has been leaked, do not respond. Report it to the security team immediately.

Deadline: Immediate (Please ensure awareness)

Subject: [Info] Data Breach via BOLA (Broken Object Level Authorization) Vulnerability

Dear Team,

We are sharing a recent security incident involving a data breach at Socar, a Korean car-sharing service.

■ Overview
An attacker exploited a Broken Object Level Authorization (BOLA) vulnerability in an internal member lookup API. Due to insufficient validation of object-level permissions, the attacker was able to access and leak the personal information of 248 customers.

■ Scope
- All applications implementing APIs that allow access to specific resources via identifiers.

■ Mitigation Steps
1. Review API endpoints to ensure that the requesting user has explicit permission to access the specific object (e.g., User ID) requested.
2. Verify that authorization checks are performed at the resource level, not just at the initial authentication stage.
3. Implement monitoring and alerting for anomalous API traffic, such as ID enumeration patterns.

■ Reference
- OWASP API Security Top 10 (API1:2019 / API1:2023 Broken Object Level Authorization)

Priority: Medium
Deadline: Next scheduled security review

Subject: [Security Alert] Beware of Deceptive URLs and Phishing Sites

Hi everyone,
We would like to alert you to a sophisticated phishing technique where attackers create fake website addresses that look almost identical to genuine ones.

What we need from you:
1. Avoid clicking on suspicious links sent via email or chat messages.
2. Use saved bookmarks or manually type the official URL when accessing critical systems or banking sites.
3. Report any unusual login prompts or security warnings to the IT department immediately.

Deadline: Effective immediately

Subject: [Security Alert] Beware of Sophisticated AI-Powered Phishing

Dear employees,

We would like to alert you to the rise of cyberattacks using AI to create highly convincing fake emails and messages to steal sensitive information.

Requested Actions:
1. Even if the sender appears to be someone you know, please verify the request via a different communication channel (e.g., phone call) if it involves urgent payments or sensitive data.
2. Do not click on suspicious links or open unexpected attachments.
3. Report any suspicious emails to the IT Security team immediately.

Deadline: Ongoing vigilance required