CERT Tonga is warning Government agencies, businesses and individuals to strengthen email security after cybercriminals compromised a business email account at a Pacific Island government agency, raising concerns about the risk of further attacks in Tonga.

In a Business Email Compromise (BEC) advisory, CERT Tonga said it had observed an increase in cyber threats involving compromised business email accounts over recent months, particularly across South Asia and the Pacific.

The advisory detailed an incident in which a threat actor gained access to a manager’s email account at an unnamed Pacific government agency, exploiting weak passwords, a lack of multi-factor authentication and inadequate security controls.

The compromised account was then used to access other email accounts and distribute mass phishing emails. Although the incident caused no major disruption to affected communities, CERT Tonga warned that similar attacks could result in significant cyber and digital harm.

How businesses can protect themselves

CERT Tonga warned that compromised business email accounts can provide attackers with access to other systems, potentially causing financial losses, operational disruption and reputational damage.

The agency urged Tongan businesses and Government organisations to strengthen their email security, particularly those relying on Microsoft 365 and other business email systems.

Its recommendations include:

• Enable multi-factor authentication (MFA): Require additional verification beyond passwords, particularly for accounts with administrative access.
• Strengthen email security: Use advanced email filtering, anti-malware protection, attachment and URL scanning, and restrictions on external email forwarding.
• Improve access controls: Introduce conditional access policies that assess factors such as location, device security and unusual sign-in activity.
• Use official email accounts: Ensure public servants conduct work-related correspondence through Government email systems rather than personal accounts.
• Improve staff awareness: Train employees to recognise phishing emails and other attempts to steal login credentials.

The advisory also highlights the importance of having appropriate systems and permissions in place to detect, investigate and respond to cyber incidents.

Potential risks for Tonga

CERT Tonga warned that business email compromise can extend beyond the organisation initially targeted, potentially exposing other Government agencies and businesses to further attacks.

The agency encouraged organisations to act on the recommended security measures and seek assistance if they suspect their email accounts have been compromised.

Businesses and individuals requiring advice or incident response assistance can contact CERT Tonga through its website at cert.gov.to, by email at cert@cert.gov.to or by telephone on 2378.