In a televised news segment, host Speaker A interviews former White House CIO Theresa Payton and McAfee security expert Robert Siciliano about two pressing cyber‑security threats. First, they discuss a long‑standing malware campaign that infiltrated U.S. power, water and utility companies, operating as sleeper cells for years before detection. Payton notes that the Department of Homeland Security was aware of the threat as early as 2011, highlighting the difficulty of protecting critical infrastructure. Siciliano explains the real‑world consequences of large‑scale outages, citing past blackouts in New York and the chaos after Hurricane Sandy. The conversation then shifts to the recent Home Depot breach that exposed roughly 53 million email addresses. Siciliano describes how attackers use the stolen addresses for phishing and malware distribution, showing a sample spear‑phishing email that fooled a Fox producer. Payton adds practical advice: use separate email accounts for financial versus retail activities, report suspicious messages to the impersonated company, the FTC, and the FBI, and never click links in unsolicited emails. Siciliano stresses that individuals must stay vigilant 24/7 because corporate defenses may not extend to home environments. The segment closes with a reminder to educate family members about these threats.
Chapters
And here we go again, yet another cyber hack. This time, our nation's critical infrastructure under threat. Hackers targeting our power plants, water treatment facilities, and more. Joining me now to discuss this is Theresa Payton, Fortalease CEO and former White House Chief Information Officer, and McAfee Online Security expert Robert Siciliano. Uh, I gotta tell you, the government is saying that this Trojan horse is poised to cause an economic Catastrophe. Teresa, to you first. Why is this so serious and what's at stake?
Yeah, you're absolutely right. This is very serious. A couple of things are at stake here. First of all, the fact that they got into the infrastructure at multiple different energy companies and they were almost like sleeper cells because we didn't know that the malware was there until it was discovered for about 3 years. The next piece is we need to be ever vigilant and remembering that our U.S. infrastructure is constantly being targeted, constantly under attack.
Well, Robert, what is the potential impact? What could happen here?
Well, the fact that New York City and a certain part of the region had gone dark a number of years back and significantly disrupted traffic and the ability to get gasoline to certain locations, and even looking back at Hurricane Sandy, or Storm Sandy. You know, it's those issues where we lose power that disrupts the flow of everyone's everyday functions is where the problems begin.
Unbelievable.
Yeah. Once that occurs, people don't know what to do. They're not prepared for issues like that.
Teresa, apparently the Department of Homeland Security knew about this way back in 2011. Why are we only finding out about this now?
Well, I think, you know, they've put out a report which talks a little bit about what the findings were, what the dangers were, and now what they're thinking about doing to help energy, utility, water companies better protect themselves. So part of this is a public service announcement so that we can be upping our game, just like the cyber criminals and cyber terrorists are upping their game.
Robert, I want to turn to Home Depot. We got some new news, more bad news on their data breach. Uh, I think they've got something like 53 million email addresses that have been breached. Uh, how important is this? Because a lot of people say, well, email addresses, who cares?
Well, the people whose emails are now in the hands of bad guys more than likely will begin to receive phishing emails, emails looking like they're coming from Home Depot or other retailers for that matter, and essentially trying to get usernames and passwords for different websites, and ultimately bad guys installing malware on the devices of those whose emails have been compromised. So anytime you receive any outgoing communication or incoming communication, always be suspect. I never click on links these days because it's just too easy to send out those communications now.
I want to show folks what we're talking about. So if you're one of those people whose email has been compromised here, the real threat here is that you might get a phishing email. And we actually got one of these. Our senior producer Kevin got one of these. So here is the initial email that you can see right here that he got. And it looks— I mean, I might have clicked on that. It says, WhatsApp says you have a new voicemail. It's for you. You know, they kind of target you, Teresa. They make you feel like they're going to give you something important. Uh, what should you do when you see something like this?
Well, I think the first thing is, is we all need to remember that cyber criminals who are stealing this information, that all roads lead to the dark web where they're amassing massive amounts of data about consumers and businesses. There are a couple of things. The first thing is, is you want to make sure the email address you're using with your bank account is not the same one you're giving to retail stores and other places that may get hacked. That's a good idea. Yeah, and the second thing is, is if you do see a spear phishing email like this, social engineering, you can actually report it back to the company that it's pretending to be, as well as to the FTC at ftc.gov or the FBI at ic3.gov. Those are great ways to make sure that everybody else is aware these spear phishing attempts are happening.
Job number one though is not to open this thing, and let me tell you, if you do open it, this is what it would look like. This is what the email to my senior producer look like. It said, you have a new voicemail, and there's a button to play. And fortunately for Kevin, we have a super serious program here at Fox that will catch all this stuff. Take a look at this: content blocked by your organization. Uh, Robert, to you, uh, you can't necessarily rely on this kind of security when you're at home, so you have to be super vigilant as an individual, right?
That is correct. And you should expect that emails like this will be coming in every single day. These are what's called advanced persistent threats, where these criminals have nothing but time on their hands, and their job is to communicate with you in a number of different ways. They target you via social, they target you via your email, and they're going to find your friends and family and send them the same communications. So you really need to be on guard 24/7, 365, and never click the links in the body of the emails. And just recognize that, you know, it is up to you to protect yourself because no one else is going to do it for you. For you.
And tell Mom and Dad, because Mom and Dad may not get it. Thanks, guys. Teresa and Robert, great job. Thanks for the info. Have a great weekend.
