Spear phishing from a former client's legitimate address steered The Standard (Standard Insurance Company) employees into a live Attacker-in-the-Middle intercept of email sign-in. According to the Maryland Attorney General breach notice, The Standard used multi-factor authentication for email access, yet the actor still captured live sign-in sessions and intermittently reached several employee mailboxes from 20 April through 25 April 2023. Names and Social Security numbers were among the potentially exposed mailbox contents; four Maryland residents received notice after a broader review. Public reporting does not name the MFA factor type, a threat actor, or a total headcount beyond several accounts and those four notices.
For the prevention angle on this workforce email path, see the related article on mfa2point0.com.
FAQ
How did attackers get into The Standard employee email?
The attackers got into The Standard employee email through spear phishing that led staff into an Attacker-in-the-Middle intercept of the email sign-in session. According to the Maryland Attorney General notice for The Standard, the company used MFA for email access, but the actor intercepted the user's sign-in session through a reverse-proxy path and obtained a live mailbox session. Unauthorized access to several employee mailboxes then ran intermittently from 20 April to 25 April 2023, until The Standard's security team detected it.
Did MFA stop The Standard email session theft?
No. MFA was in use for The Standard email access and still did not stop this incident, because the attack was live Attacker-in-the-Middle session interception rather than a missing second factor. An AiTM path completes the login ceremony in real time through the attacker's proxy, so the real service issues a session the attacker can hold. Public reporting does not establish which MFA method The Standard used on email.
What was stolen at The Standard: passwords or sessions?
The Standard incident started as credential-phase AiTM against email sign-in, then became residual session access to mailboxes once the intercepted sign-in existed. With that session, the actor could read mailbox content without another login. MFA at a later prompt does not undo a session the attacker already holds; detection and invalidation close that window. The same reverse-proxy pattern showed up later in UK industrial AiTM workforce campaigns.
How many people were affected in The Standard breach?
Public reporting establishes unauthorized access to several The Standard employee email accounts and notice to four Maryland residents after mailbox review. Potentially exposed content included names and Social Security numbers, and may have included address, date of birth, and insurance, salary, or member identifiers. Public reporting does not establish a full individual count beyond those figures.
Is there a fix for this kind of email AiTM path?
Yes. A fix exists for the live capture path AiTM kits need at workforce email sign-in: authentication with no transferable factor the proxy can relay. That stops the kit from harvesting a usable session in the first place. It is not a claim that any MFA erases mailbox reading after a session already exists; revoke and review remain hygiene for that residual window. The prevention write-up is on the companion post linked above.
