The email had not come from a stranger.
Cybercrime: Malice in Everyday Life — Part 1
You don't have to be someone special to be targeted.
Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life.
From Someone She Knew
One morning, Alice was checking her work email, as she usually did.
She handled administrative work at a small company: processing invoices, corresponding with business partners, and taking care of small internal arrangements. None of it was particularly unusual, but there were many things that would not get done without her.
Among the messages in her inbox was one from a contact at a business partner's company.
The subject line read: "A shared file has been updated."
The message contained a brief note asking her to review the updated file, along with a single link.
She had worked with this person for years. They had exchanged countless emails about invoices, delivery dates, and other routine matters.
Alice clicked the link.
The page that appeared was a login screen for a cloud service she used regularly. At least, that was what it looked like at the time.
— Perhaps my login session has expired.
That was what she thought, so she entered her work email address and password.
The page continued loading for a little while, but it never displayed properly.
"Maybe the system is having trouble again," she thought.
Alice moved on to another task.
It did not occur to her that anything was wrong.
The Email She Never Sent
A few days later, a call came in from the business partner.
"We just received an email under your name, Alice. It asked us to review a shared file..."
Alice had no idea what they were talking about.
She checked her sent folder. She had no memory of sending such a message. Yet the email administration console showed a large number of sent messages she did not recognize.
When an employee responsible for system administration looked into the matter, the situation turned out to be even worse.
A third party had gained unauthorized access to Alice's email account.
Her past emails had also been read. They contained email addresses belonging to business partners and customers, along with records of work-related conversations.
And more than 1,000 phishing emails had been sent from Alice's account to people both inside and outside the organization.
The sender was Alice herself.
The email address was genuine, too.
To the recipients, the messages may have looked like ordinary emails from someone who regularly contacted them about work.
The Damage Didn't Stop with Her
The company forcibly reset the password for Alice's email account.
It contacted anyone whose information might have been exposed, apologizing and warning them to be cautious. The company also began considering the introduction of multi-factor authentication.
But that was not the end of the problem.
Alice's mailbox contained years of correspondence with business partners. Email addresses were collected from those messages, and those people became targets themselves.
What made matters worse was that the emails they received had been sent from Alice's account through the organization's legitimate email system.
This was not simple spoofing, in which an attacker merely makes a fake sender name appear on a message. Both the sender's name and email address belonged to a real, actively used account. It was not easy for recipients to recognize that something was wrong.
Alice had not been trying to deceive anyone.
She had simply opened an email from someone she worked with regularly and logged in as she always did.
And yet her email account had become a launch point for someone she had never known.
Is This Really Unusual?
This incident is based on an actual case reported by the Information-technology Promotion Agency (IPA).
It was one of the reports accepted during the first half of 2020. The incident began when someone clicked a link in a phishing email that appeared to come from a business contact and entered their ID and password on a fake login page.
The attacker used the compromised email account to send more than 1,000 phishing emails to people inside and outside the organization. The attacker also collected customer and business-partner email addresses from previously exchanged messages.
The IPA describes this kind of attack—where legitimate accounts are abused to spread attacks both within and beyond an organization—as "lateral phishing."
And phishing is not a thing of the past.
According to the Phishing Report 2026 published by the Anti-Phishing Council, the Council received 2,454,297 phishing reports in 2025. That was approximately 1.43 times the number received in 2024.
These figures do not represent the number of victims or the number of successful scams. Even so, they show that phishing continues to be reported on a large scale.
What Should She Have Trusted?
Alice was not someone who carelessly opened suspicious emails from anyone and everyone.
She was cautious about messages from people she did not know, and she did not open suspicious attachments without thinking.
But this time, the message had not come from a stranger.
What is more, the attacker had not simply borrowed the business contact's name. The attacker appears to have first compromised an account belonging to someone connected to the organization, then contacted Alice from an email account that was actually in use.
"It's safe because it came from someone I know."
Even a careful person can make the wrong call when relying on that assumption.
Of course, it would not be realistic to treat every email with suspicion or to call and verify every message, no matter who sent it.
So how careful should she have been?
And was this really something Alice could have prevented through her own vigilance alone?
More than 1,000 emails had been sent from her account. Some of their recipients may still have trusted her.
And in those people's inboxes, too, another email from someone they know may arrive today.
References
Information-technology Promotion Agency (IPA), Reported Cases of Computer Viruses and Unauthorized Access [First Half of 2020] (August 6, 2020), Chapter 4, "Unauthorized Access to an Account for a Cloud-Based Email Service"
https://www.ipa.go.jp/security/todokede/crack-virus/ug65p9000000nnpa-att/000084707.pdfAnti-Phishing Council, Phishing Report 2026 (June 1, 2026)
https://www.antiphishing.jp/report/report/phishing_report2026.htmlNational Police Agency, Anti-Phishing Measures
https://www.npa.go.jp/bureau/cyber/countermeasures/phishing.html
Note on the organizations: The Information-technology Promotion Agency (IPA) is a Japanese independent administrative agency. The Anti-Phishing Council and the National Police Agency are also Japan-based organizations.
The story in this article is a narrative reconstruction based on an incident report published by the IPA. The people, company setting, conversations, and timeline have been adapted for readability. It does not depict any specific company or individual.
Top comments (0)