Imagine: it's morning and you're at work.
You open your email and see a message:
“Urgent: please approve the latest payment”
The sender is your company's director.
An invoice is attached.
The text looks normal.
The name is right.
The company name is right.
There's even something that looks like your director's signature.
You open the file.
A few minutes later it may already be too late.
But the most interesting question is this:
How did the attacker know to send that email to you in particular?
They didn't pick you at random.
Attackers start with information, not passwords
One of the most important stages of a cyberattack often isn't the “hack” itself.
It's gathering information.
This is called OSINT — Open-Source Intelligence: collecting and analysing information from public sources.
An attacker can study everything a company and its employees have published online.
And the problem is that in many cases nothing secret is needed at all.
LinkedIn may already be enough
Say the attacker finds the company's LinkedIn page.
A few minutes later they can already work out:
- who the director is,
- who the accountant is,
- who the sales manager is,
- who handles HR,
- who the IT specialist is,
- who the new employees are.
For example:
Anna — Accountant
Davit — Sales Manager
Karen — IT Specialist
Aram — CEO
Now the attacker has a small “org chart” of the company.
And the next question becomes:
who is the easiest target?
Different bait for different people
If the attacker has chosen the accountant, there's no point sending them a “new client enquiry”.
This would be more convincing:
“Hi Anna, please find attached this month's invoice for payment. Could you check and approve it?”
For the sales manager it might be:
“The new client's contract is attached. Please review it by the end of the day.”
And the manager might get:
“This document needs your approval urgently.”
In other words, the attacker isn't just sending a phishing email.
They're trying to build a story that fits the context of your job.
That's the power of social engineering.
And how do they know the email address?
This is where the next layer begins.
A company website may publish:
info@company.am
hr@company.am
sales@company.am
or employees' contact details.
Other sources can then reveal the company's email format.
For example:
name.surname@company.am
If you already know someone's first and last name, that format can be very useful for targeting.
On top of that, email addresses sometimes appear in public datasets or in past data breaches.
So the attacker can end up knowing not only that
“Anna works at this company”,
but also that
“this is Anna's email”.
Social media is a source of information too
People often think:
“I don't post anything secret.”
But information doesn't have to be secret to be useful.
For example, an employee posts on Instagram or Facebook:
“Finally, holidays 😎✈️”
To an attacker, that may mean the person will be unreachable for a while.
Someone else writes:
“First day at my new job today.”
Now the attacker knows there's a new employee at the company.
A new employee may not yet know the internal procedures, the systems in use or the security rules.
And that can become an extra risk.
But OSINT isn't only about people
Attackers are also interested in a company's technical environment.
For example, which subdomains the company has:
crm.company.am
mail.company.am
vpn.company.am
dev.company.am
Or which services it uses.
They may also be interested in:
- public IP addresses,
- DNS records,
- exposed services,
- the technologies in use,
- public repositories,
- published documents,
- metadata,
- past data breaches.
Put together, all this information can paint a fairly detailed picture of the company.
And this is where real social engineering begins
Say the attacker already knows:
Aram — CEO
Anna — Accountant
Davit — Sales
CRM — used by the sales team
Email — used across the company
Now they can create not generic phishing but a specific scenario.
For example:
Anna,
please check this invoice and approve the payment.
Aram
Even if the email isn't really from Aram, Anna may not suspect a thing.
Because the attacker isn't just trying to fool her.
They're trying to become part of her working environment.
What if the employee doesn't click the link?
Then the attacker may try another route.
For example, sending a page that looks like a login page.
The employee sees:
Microsoft 365 Login
or
Company CRM Login
They enter their email and password.
And that's it.
Those credentials may now be in the attacker's hands.
What can follow are attempts at account takeover, data access or getting into internal systems.
So what does the CRM have to do with it?
In many businesses a CRM isn't just “a list of clients”.
It can contain:
- client names,
- phone numbers,
- email addresses,
- addresses,
- orders,
- contracts,
- payment details,
- employee actions,
- internal notes.
In other words, a CRM can become one of the company's most important information systems.
So the question isn't only:
“Can the CRM be hacked?”
The more important question is:
“If someone gets hold of an employee's account, what can they do with it?”
That's why access control matters
For example, a salesperson doesn't need the same access as an administrator.
If an employee only needs to work with clients, they shouldn't be able to:
- change every system setting,
- create users,
- export the entire database,
- delete important data.
This is called the principle of least privilege.
Every user should have exactly as many rights as their job requires.
No more.
And what if someone changes the data?
This is where an audit log comes in.
For example:
09:41 — Anna — changed a client's phone number
10:03 — Davit — changed an order's status
10:17 — Admin — created a new user
Records like these let you see not only what happened, but also who did it and when.
That matters for security and for keeping ordinary business processes under control.
And then an employee leaves
This is another very often forgotten topic.
An employee leaves the company.
But their account stays active.
They may still have access to:
- the CRM,
- email,
- cloud storage,
- the VPN,
- internal systems.
From a security point of view, that's a serious problem.
Employee onboarding and offboarding must be controlled processes too.
So what does the attacker see?
You might see:
LinkedIn → job posting → website → CRM
while the attacker sees:
people → roles → email addresses → systems → access → potential targets
And they can use that information to craft one very convincing phishing message.
What a business can do
There's no need to wait until someone clicks a phishing link.
You can start with very simple steps:
- A separate account for every employee
- Limited administrator rights
- MFA on every important system where possible
- Regularly review user permissions
- Disable a departing employee's account immediately
- Audit logging
- Backups
- Phishing awareness training for staff
- Don't publish unnecessary internal information
- Regularly check what information about the company is available online
The most dangerous vulnerability sometimes isn't software
In cybersecurity we often think:
“We need to protect the server.”
Yes.
The server needs protecting.
But so do people.
Because an attacker may not try to break into the server at all.
They may simply try to convince one employee that they're the director.
And if that works, it can open a way around some of your technical defences.
Sometimes an attacker doesn't need to break into your system.
It's enough to get you to open the door yourself.
TM Hub × Cybersecurity
In a modern business, a CRM isn't just a sales management tool.
It's also where important business information is gathered and processed.
That's why, when choosing a CRM, you should think not only about features but also about:
Who has access?
Who can change data?
Who can delete it?
Who can see it?
What does the system record?
What happens if an employee's account is compromised?
Cybersecurity isn't a separate “IT topic”.
It's part of a business's everyday processes.
Because data has value. And everything of value needs protecting.
