The alert
On September 22, 2021, the American Land Title Association (ALTA) notified members of a phishing email with the subject line “ATTN: TITLE POLICIES.” Recipients were told to delete it. An earlier message had used the subject line “ALTA: VIOLATION IN ALTA RULES AND THE FAA.”
This note records that alert. It is not a report of a current incident, and it is not a statement about the security of any particular company’s systems.
How the messages were presented
The emails referred to an attachment and used the domain starzbreak.com. They appeared to come from ALTA’s chief executive, Diane Tomb, or from a member of ALTA’s Board of Governors.
What recipients were advised to do
Do not open an attachment or follow a link in a message of this kind. Ask your information-technology department to block the sending domain or the address from which the message originated. Campaigns of this type often move to a new domain after the first one is blocked.
Review unexpected email on a phone with particular care. A display name can conceal the actual address.
A phishing message is not, by itself, evidence that a title company’s systems have been compromised. Confirm any unexpected request for policies, credentials, or payment instructions by calling a number you already know.