BreachesMar 18, 2026

Nordstrom's email system abused to send crypto scams to customers

Nordstrom's email system was compromised and used to send cryptocurrency scam messages to customers, impersonating legitimate company communications with a St. Patrick's Day promotion disguise. The breach reportedly occurred through an Okta SSO to Salesforce compromise, resulting in at least $5,600 in fraudulent cryptocurrency transfers before the company issued a warning to customers.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

What helps against this

How we list vendors

Okta affected

Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
For exampleVectra AI Platform Acalvio ShadowPlex Identity Protection CrowdStrike Falcon Identity Protection all options
Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
For exampleProofpoint Email Fraud Defense Red Sift OnDMARC Valimail Enforce all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleMicrosoft Defender for Office 365 Check Point Harmony Email & Collaboration Mimecast Email Security all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

email — nordstrom@eml.nordstrom.com
mitre_attack — T1566.002
mitre_attack — T1621