Police department says its email account was hacked

Grand Coulee Police said Tuesday that their department email account had been “hacked,” after they were notified about 9:45 a.m. of a potential spam email that had been sent from Chief John Tufts account, containing an unknown attachment.

The list of recipients was not known, but multiple organizations began notifying the MACC (Multiple Agency Communications Center) dispatchers that they had received the suspicious email, which contained an altered disclaimer and department name that indicated it was of a foreign origin.

“Chief Tufts and Officers immediately notified Mayor Townsend, WASPC [Washington Association of Sheriffs and Police Chiefs], city employees, and potential government recipients,” a department release stated.

Tufts contacted the departments IT contractor, who took immediate action to prevent further access but could not determine the source of the intrusion, the GCPD release said.

The email, also received by The Star, claimed to have a document attached “completely from Grand Coulee Home Police Department” but also referenced “Trans-World Shipping” in what appears to be an attempt to imitate boilerplate disclaimer language at the bottom. An image at the top purportedly of an “eFax” message, invited the recipient to click on a button to “Preview PDF Here” but clicking anywhere on the upper portion of the email could have executed some command, as indicated by a cursor change.

CNBC reported that a study released in October 2022 found a 61% increase in the rate of phishing attacks over the previous year, and they’re getting more sophisticated all the time. Criminals are not using email alone. Attackers also leave voicemail or send a text about the email they just sent, which lends more credibility to the email just sent.

The GCPD release recommended visiting the Federal Trade Commission’s site for information on avoiding such “phishing” scams at https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams.