A $5.29M risk: Are you ready for today's phishing attacks?

Party invitations are the hottest email phishing scam this summer.  

Phishing is old news. But this newest iteration can bamboozle even those of us who work in tech and are trained to look for "phishy" things. 

These "invitations" appear to come from reputable platforms such as Evite, Paperless Post and Punchbowl. And they are from people you know, with legitimate email addresses. It appears everything checks out -- and then you unwittingly give out a password or some other personal information.  

CIOs, I am your cautionary tale. I'm not a security expert. I represent your average employee -- educated, cautious, yet still vulnerable.  

I fell victim to this scam.  

A Punchbowl "invitation" arrived in my personal email account, inviting me to a summer soiree hosted by a member of an organization that hosts such get-togethers, so I thought nothing of it. I clicked on it, and nothing good followed. 

A few weeks later, there was an unauthorized sign-in to my email account. My contacts started receiving similar "invitations" that appeared to come from me. My heart nearly stopped. I never thought I'd fall for a phishing scam, until I did. It was the summer gift that just kept on giving! 

I spent the better part of a week changing login information on various accounts, created a new email address and enabled two-factor authentication on my email accounts. And of course, I had to tell everyone I knew not to open any Punchbowl invitations that appeared to come from me. Thankfully, my email was the only account breached. It could have been worse. But I felt horrible knowing that many of my contacts did click on that suspicious email and were now targets themselves. 

We are all one click away from disaster. 

Personal email addresses are not the only accounts being targeted. These phishing emails are also going to corporate addresses. According to IBM's Cost of a Data Breach Report 2026, phishing was the top attack vector into breached organizations for the fourth year in a row. The average cost of a breach now comes in at $5.29 million. 

How many of your employees have been phished and never reported it?  

If threat actors get their hands on corporate login information, trade secrets or other sensitive and confidential information could be leaked. But beyond that, compromised corporate email can be used to target vendors, partners and customers. It can cause reputational damage, affecting customer trust and stock prices. Ransomware could follow and bring serious business disruption. 

Beyond basic email spam filters, there are some things that businesses should do to keep employees -- and in turn, the business -- safe: 

• Zero trust architecture, denies access to a business's digital resources by default and grants access only to authenticated users.  

• Enterprise password managers and passwordless authentication, which securely store credentials and verify identity without traditional passwords. 

• Endpoint detection and response tools, which will identify and contain threats post-click.  

Yearly security compliance training should also be scheduled to ensure employees do their part in keeping businesses secure. Regular, realistic phishing simulation programs should also be scheduled, along with just-in-time training for employees who fail those tests.  

C-suite executives can be especially high-value targets for threat actors, and even more specialized training should be considered for them. Are you confident your executives wouldn't fall for this?