West Midlands Trains emailed approximately 2,500 employees to announce they'd all receive a bonus as appreciation for the "huge strain [that] was placed upon a large number of our workforce." Turned out though, if an employee clicked the link for more information, they'd land on a page revealing that the email was a "phishing simulation test" and, guess what, there was no actual bonus happening. From The Guardian:
[Leader of the Transport Salaried Staffs' Association (TSSA) union Manuel] Cortes said the company should apologise and now pay an actual bonus, to begin to make amends.
"In that way the company can begin to right a wrong which has needlessly caused so much hurt."
A West Midlands Trains spokesperson said: "We take cybersecurity very seriously. We run regular training and it's important to test your resilience.
"The design of the email was just the sort of thing a criminal organisation would use – and thankfully it was an exercise without the consequences of a real attack."