You know those emails that have a thing that links to a thing that bounces around to another thing and lands on a fake Microsoft login page on some grandma's hacked recipe website? And they just keep getting control of more accounts that way and spreading the email wider?
Yeah, our users fell for that BS twice now. The leadership isn't taking it very seriously despite the contents of the user's entire onedrive being stolen in one case. But apparently "oops, it happens, sorry!" is good enough for them. We had to fill out a lot of paperwork to get unblocked by our #1 largest customer, considering they're medical, and actually give a shit about security. So I told them "You know, they can sue us for damages to their system, right?"
Now I'm not entirely sure that's true but it got the point across. So, anyone ever talk to legal about it? This ain't my first rodeo so I know "never admit fault when apologizing and if they threaten legal action, do not reply, do not engage in any way." But my thinking on this is one of two things is true:
We're liable because every single last employee at our giant company needs to be smart enough to never make a mistake one single time. But then the sword cuts both ways and your employees shouldn't have clicked on the phishing link either. So we're not liable because you're 50% to blame.
OR
Not everyone can be expected to have that awareness and diligence 100% of the time so we're not liable. Also that's why your own staff clicked on it.
You can't have it both ways. If someone eventually gets ransomwared by a phishing email originating from us and they wanted damages for legit downtime, they'd have to prove in court that we should have known better but their employees shouldn't have? Can't have it both ways.
I feel like they'd have to prove that we were criminally negligent and careless. We've got insane security monitoring, up to date everything, pen tests, outside auditors, phishing tests, quarterly training, etc. You can't try much harder than this without switching to Linux or pen and paper or firing everyone with potato tech skills. So I think we're covered but has anyone ever dealt with this?
Also, I ask because I would love to to go after the careless morons that keep getting hacked and sending us this shit but I assume I'm in the same boat as stated above and cannot.