AOL Probes 'Unauthorized' Security Breach, Spamming Scheme

AOL (NYSE:AOL) has launched an investigation into a “security incident” that involved the unauthorized access of customer and employee data – including encrypted passwords.

The probe comes after a “significant increase” in the amount of spam appearing as “spoofed emails” from AOL email addresses.

The scamming tactic is designed so that the emailed message appears to be sent legitimately from a known recipient – thus increasing the chances the victim will click on a malicious link.

The New York-based tech giant says it is working with external forensic experts and federal authorities to investigate the breach. While it has begun notifying potentially affected users, it is encouraging all users and employees to reset passwords and security answers for AOL services.

“The ongoing investigation of this serious criminal activity is our top priority,” AOL said. “Our security team has put enhanced protective measures in place and we urge our users to take proactive steps to help ensure the security of their accounts.”

Though the investigation remains ongoing, AOL said it has so far determined that there was unauthorized access to information regarding a “number of user accounts,” including email addresses, postal addresses, contact information, encrypted passwords and encrypted answers to security questions, as well as certain employee information.

The company said it has no information indicating that the encryption on the passwords and security questions was broken, and does not believe customer financial information, including encrypted credit card information, was accessed.

However, it believes spammers have used this stolen contact information to send spoofed emails that appeared to come from roughly 2% of its email accounts.

“These emails do not originate from the sender’s email or email service provider — the addresses are just edited to make them appear that way,” AOL said in a note to customers.

Shares of AOL were up 1% to $42.45 in recent trade.