Ohio Staff Phished, Cybercrooks Mimic FBI, Regulator Attacked Millions

Domain spoofing is trivially easy without DMARC enforcement, says Brad Slavin, General Manager of DuoCircle. Anyone can send email that looks like it comes from your domain. DMARC with p=reject is the only way to tell receiving servers to block unauthorized senders completely.

_According to the FBI’s 2022 Internet Crime Report (IC3), 300,497 US-based victims reported phishing incidents in a single year, and Business Email Compromise (BEC) caused more than $2.7 billion in direct losses. DMARC Report

Ohio Staff Phished, Cybercrooks Mimic FBI, Regulator Attacked Millions

					<button title="Play" aria-label="Play Episode" aria-pressed="false" class="play-btn">
						

Play Episode

					</button>
					<button title="Pause" aria-label="Pause Episode" aria-pressed="false" class="pause-btn hide">
						

Pause Episode

					</button>
					


				

				

					<audio preload="none" class="clip clip-40792">
						<source src="https://media.mailhop.org/dmarcreport/images/2026/03/Why-is-DMARC-important-for-the-retail-sector.mp3">
					</audio>
					

						

					

					

						

							<button class="player-btn player-btn__volume" title="Mute/Unmute">
								

Mute/Unmute Episode

							</button>
							<button data-skip="-10" class="player-btn player-btn__rwd" title="Rewind 10 seconds">
								

Rewind 10 Seconds

							</button>
							<button data-speed="1" class="player-btn player-btn__speed" title="Playback Speed" aria-label="Playback Speed">1x</button>
							<button data-skip="30" class="player-btn player-btn__fwd" title="Fast Forward 30 seconds">
								

Fast Forward 30 seconds

							</button>
						

						

							<time class="ssp-timer">00:00</time>
							

/

							<!-- We need actual duration here from the server -->
							<time class="ssp-duration" datetime="PT0H2M6S">2:06</time>
						

					

				

			

								<nav class="player-panels-nav">
												<button class="subscribe-btn" id="subscribe-btn-40792" title="Subscribe">Subscribe</button>
																		<button class="share-btn" id="share-btn-40792" title="Share">Share</button>
										</nav>
						

	



		

						

				

					

					

				

				

					

																																																																								

					

						

RSS Feed

							<input value="https://dmarcreport.com/feed/podcast/dmarc-report" class="input-rss input-rss-40792" title="RSS Feed URL" readonly />
						

						<button class="copy-rss copy-rss-40792" title="Copy RSS Feed URL" aria-label="Copy RSS Feed URL"></button>
					

				

			

									

				

					

					

				

				

					

						Share						

					

						<a href="https://www.facebook.com/sharer/sharer.php?u=https://dmarcreport.com/blog/podcast/ohio-staff-phished-cybercrooks-mimic-fbi-regulator-attacked-millions/&t=Ohio Staff Phished, Cybercrooks Mimic FBI, Regulator Attacked Millions" target="blank" rel="noopener noreferrer" class="share-icon facebook" title="Share on Facebook">
							

						</a>
						<a href="https://twitter.com/intent/tweet?text=https://dmarcreport.com/blog/podcast/ohio-staff-phished-cybercrooks-mimic-fbi-regulator-attacked-millions/&url=Ohio Staff Phished, Cybercrooks Mimic FBI, Regulator Attacked Millions" target="blank" rel="noopener noreferrer" class="share-icon twitter" title="Share on Twitter">
							

						</a>
						<a href="https://media.mailhop.org/dmarcreport/images/2026/03/Why-is-DMARC-important-for-the-retail-sector.mp3" target="blank" rel="noopener noreferrer" class="share-icon download" title="Download" download>
							

						</a>
					

				

				

					

						Link						

					

						<input value="https://dmarcreport.com/blog/podcast/ohio-staff-phished-cybercrooks-mimic-fbi-regulator-attacked-millions/" class="input-link input-link-40792" title="Episode URL" readonly />
					

					<button class="copy-link copy-link-40792" title="Copy Episode URL" aria-label="Copy Episode URL" readonly=""></button>
				

				

					

						Embed						

					

/*! This file is auto-generated */ ’ title=“Embed Code” class=“input-embed input-embed-40792” readonly/>

					<button class="copy-embed copy-embed-40792" title="Copy Embed Code" aria-label="Copy Embed Code"></button>
				

			

				

Last week was replete with threat attacks that managed to create chaos and disrupt essential operations. Ohio-based Scioto County employees were targeted by phishing actors. A group of cybercrooks managed to mimic the FBI to target Tron blockchain users. Meanwhile, the RBI, India’s central bank and financial regulator, was hit as many as **61 million times in just 3 months. The attack on Stryker, the medical equipment manufacturer, led to delays in critical surgeries.

Ohio County employees received phishing emails with malicious links!

A potential data breach occurred in Scioto County, where multiple employees received phishing emails containing malicious links. The Scioto County commissioners have revealed that the fake emails appeared to be coming from legitimate sources. They also feel that threat actors might have gained access to sensitive data because of employee interactions with these malicious emails.

The commissioners have agreed to collaborate with a third-party law firm, Kutak Rock, to comprehend the scope of the attack and the extent of the damage. The investigation will also help them determine whether sensitive data has been compromised.

The **County officials have been tight-lipped about the specificity of the breached data. They claim that all the necessary cybersecurity protocols have been deployed proactively to limit the impact of the attack. Local leaders are monitoring this matter closely and have emphasized that appropriate cybersecurity measures are being considered to prevent similar incidents in the future. From stringent **email filtering systems to employee training and latest security procedures, experts are considering some of the best preventive measures to secure the County’s data from future cyberattacks.

There’s no information yet on whether the personal data of employees was compromised. Cybersecurity experts warn that properly configuring DMARC, DKIM, and SPF is essential to **protect personal data from phishing attacks and email spoofing threats.

Cybercrooks targeting Tron blockchain users by mimicking the FBI

A new phishing scam is doing the rounds. The scamsters are impersonating the FBI to target users of the Tron blockchain. The FBI has issued a warning against such phishing attacks. The cybercrooks use specially designed counterfeit tokens that look quite similar to the official branding of the FBI. The threat actors dispatch “FBI-branded” tokens to wallets. Additionally, they share a message saying that the user account is currently being probed. Further, the victims are compelled to complete a verification process in order to **prevent their crypto assets from being locked out. Cybersecurity experts believe that the phishing scam is designed to wipe away personal data as well as access the funds of the victims.

Each dispatched token creates a sense of urgency and panic. The victims are then redirected to fake websites where they are required to enter their personal information (wallet details and identification). The cybercrooks can also use a tactic called “address poisoning.”

The FBI has urged Tron blockchain users to “exercise caution.” Also, Tron users are requested not to share “any identifying information to any website associated with such token.” The federal agency has also stated that the **FBI will never issue such tokens or request user verification through such illegitimate methods.

India’s primary financial regulator targeted 61 million times in Q4 2025!

RBI, the central bank and primary financial regulator of India, was targeted 61 million times in just 3 months. Thankfully, RBI was able to avert every threat attempt by leveraging its firewall and security engines.

The staggering number of attempts underscores the steep rise in threats against critical financial infrastructure.

Each and every threat attempt was successfully mitigated by **RBI’s cybersecurity systems with zero instances of data leak or breach. The sheer number of attacks definitely appears alarming. However, experts believe that these numbers reflect only malicious traffic attempts, not successful intrusions.

But the sharp upward trajectory in threat attempts is indeed a cause of concern. It definitely hints towards a broader global pattern in which threat actors target financial institutions with automated, high-volume cyberattacks.

Stryker cyber mishap led to delayed surgeries!

Stryker, a medical equipment manufacturer, was targeted by threat actors last week. As a result, some hospitals had to delay a few surgeries.

Due to the cyberattack, Stryker experienced a temporary disruption in its daily operations. Stryker was unable to deliver customized **medical inventory **to health organizations. A Stryker spokesperson stated that, due to this disruption, “some patient-specific cases have been rescheduled.”

Handal, a notorious cyber gang, has claimed responsibility for the threat attack on Stryker. The attack was designed carefully to disrupt Stryker’s core operations, such as processing orders, making products, and dispatching them to customers. Stryker has managed to contain the threat attack on time. Also, the attackers were unable to access to any patient’s personal data.