Cybersecurity Alert: Blackmail Email Threats Targeting Public Figures

In recent months, a disturbing trend has emerged across Taiwan, Hong Kong, and Macao with blackmail email threats targeting prominent public sector figures. These threats began in November 2024 and have since expanded to other regions, signaling a significant security concern.

Understanding Blackmail Email Threats

These emails are highly deceptive, originating from compromised accounts to appear legitimate, thereby increasing the likelihood that recipients will take them seriously. Primary targets include government officials, civil servants, and university professors—individuals whose visibility makes them vulnerable to severe reputational damage. The threats involve fake pornographic images digitally altered to superimpose the victim's face. The perpetrators threaten to disseminate these fabricated images via social media, professional networks, or even personal contacts unless the victim pays a substantial ransom, often demanded in untraceable cryptocurrency. This tactic exploits the fear of public humiliation and career destruction.

How to Respond to Blackmail Emails

Receiving a blackmail email can be alarming, but knowing how to respond effectively is crucial. Here are the recommended steps to take if you encounter such threats:

1. Do Not Engage: The most important rule is to avoid responding to the email. Engaging with cybercriminals can confirm that your email address is active, which may lead to further harassment or even escalation of the threats.
2. Refrain from Paying: Experts strongly advise against paying any ransom. Paying does not guarantee that the harassment will stop; in fact, it may encourage attackers to continue targeting you or to demand more money.
3. Report the Threat: Immediately report the blackmail email to the appropriate authorities or cybersecurity professionals. Reporting can help track and combat these criminal activities, potentially protecting others from similar threats.
4. Stay Informed: Keep yourself updated on cybersecurity guidelines and best practices. Understanding the strategies that cybercriminals use can better prepare you to handle such situations.
5. Maintain Vigilance: In many cases, not responding to the blackmail email can cause the threat to dissipate, especially if it is part of a broader scam aimed at eliciting a reaction. Staying vigilant and proactive is key to safeguarding your digital presence.

By following these steps, you can effectively manage the situation and reduce the risks associated with blackmail emails.

Phishing Trends

According to HKCERT statistics (https://www.hkcert.org/statistic) from January 2018 to February 2025, phishing remains the top cyber-attack method, highlighting a troubling trend of cybercriminals targeting public figures. These phishing attempts continue to be the primary threat in the realm of cyber-attacks, resulting in various forms of exploitation.

  
Protective Measures and User Account Security

To safeguard against such threats:

• Enhance Account Security: Use strong, unique passwords and enable Multi-Factor Authentication (MFA).
• Exercise Email Caution: Be vigilant with emails from unknown senders, especially those with suspicious links or attachments.
• Monitor Accounts Regularly: Regularly review account activity for signs of unauthorised access.
• Stay Updated: Keep operating systems, browsers, and other software updated to address security vulnerabilities.

Take Immediate action if compromised:

• Change passwords immediately, ensuring they meet security standards.
• Check for any suspicious activity, such as unauthorised emails sent from the account.
• Notify contacts if the account has been misused to send spam or malicious content.
• Run antivirus software to detect and remove any malware.

Conclusion

Ignoring blackmail attempts is crucial. This article underscores the need for vigilance against cyber-attacks, particularly for public figures. Stay informed and proactive to protect against these malicious activities.

For more resources, visit the CSC website’s "Training and Awareness" section or contact infosec@cityu.edu.hk for enquiries.