by chrisbuc on 9/18/2022, 5:35:13 AM
Urgh - I got one of these - completely forgot that I'd set up a fogbugz account years ago. Don't know if these invoices are as a result of a hack, or whether it's because it's now owned by another company and they're pre-emptively "upgrading" previously free accounts to "paid" accounts in the hope that they're going to get some subscriptions...
The email had some vlaid account fogbugz account details, so it's at least coming from their database...
It's been reported that FogBugz started sending large amount of fraudulent invoices on or about Friday 16th September 2022.
See twitter and HN threads about the issue https://twitter.com/josephruscio/status/1570957688405917698
If you have received fraudulent emails and invoices from FogBugz, there's a very simple first step you can do to help prevent harm to other victims.
* In Firefox, you can open the website https://fogbugz.com/sign-in/ , then open "Help" menu, "Report Deceptive website".
* In any browser, you can open the page to report deceptive websites here https://safebrowsing.google.com/safebrowsing/report_phish/ then fill in the URL https://fogbugz.com/sign-in/
Google and Firefox maintain a list of websites performing active attacks of phishing/fraud/malware/etc. The lists are updated in the background hourly or so for all users of the browsers. A site should be blocked in no time once it's been reported enough time.
It's been very effective at stopping large scale attacks in the wild. That's one of the reasons you see elaborate attacks these days having to circle through many domains, otherwise they get blocked in no time.
There may be more you can do (some comments mentioned writing to your Attorney General and starting class actions lawsuits) however these take a while to initiate and do not stop active harm in the meantime.
Regards.