The city of Antwerp sent more than 100,000 fraudulent emails after a mailing tool account was hacked.

Last week, around 150,000 fraudulent emails were sent within an hour via the email address support@antwerpen.be. In the email, the recipient read that his MetaMask wallet, a crypto wallet, had been blocked.

This message should encourage people to click a link in the email and then log in with their credentials. The entered email address and password then fell into the hands of criminals, who thus gained free access to the money in the wallet.

Mailing tool broken

The hackers gained access to an application in which the city’s mailing campaigns are carried out. You have created a new email address to send the messages. “The emails were sent from the attacker’s file, not our mailing file,” says Ellen Caluwaerts, city councilor for marketing and digitalization in Antwerp.

“The hackers were unable to access the entire Campaign Monitor environment, only a user’s specific sub-account,” she continues. The tool is separate from internal systems and the city’s IT infrastructure is not affected, writes DataNews.

The account had the ability to create new addresses for the city of Antwerp. This was because two-factor authentication was not set up for the mailing tool. This missing security measure has now been implemented.