On Monday, June 22, 2025, attorneys and law firms in Utah were targeted in a phishing scam email that falsely claimed to be from the Utah State Bar Communications Director, Jennifer Weaver. The fraudulent message was sent from the email address using Jennifer’s name and the domain @utahbar.org.virumail.com, which appeared legitimate at first glance but was in fact spoofed to deceive recipients.
The message falsely stated it was confirming recipients’ “secure communication preferences.” In reality, the message was part of a sophisticated phishing attempt using spoofing techniques to mimic trusted sources. The Bar does not use third-party services like “Virumail” and does not request sensitive information in this manner. More importantly, the Bar’s data systems were not breached, and lawyer licensing and Bar applicant information is safe and secure.
This scam did not only affect Utah. Similar messages were reported by legal professionals in Alabama, Arizona, Florida, Maryland and Oregon, indicating a coordinated attempt to target attorneys nationwide.
What You Should Do
- When in doubt, verify before you click.
- Do not click on any links or attachments in the phishing email.
- Do not reply to the sender or provide any information.
- Delete the email immediately.
If you or your firm interacted with the message in any way:
- Contact your IT department immediately.
- Visit the Utah State Bar’s website for a list of vetted cybersecurity service providers at: utahbar.org/business-partners
The Bar would like to thank the dozens of attorneys who promptly contacted the Bar after receiving the suspicious email. Your quick action helped confirm the scam early and allowed the Bar to issue an alert across our legal community.
To help our licensees better protect themselves and their firms, the Bar is committed to providing practical tools and guidance to recognize and respond to digital threats. Phishing scams, like the one impersonating the Communications Director, are becoming increasingly difficult to detect from often being designed to look convincing and urgent.
How to Spot and Handle Phishing Scams
Red Flags of a Phishing Email
- Unfamiliar or misspelled email addresses, like those with strange domains (e.g., domains like .virumail.com instead of a known, official domain)
- Missing branding: Official emails typically include Utah State Bar branding, email signatures with clear contact info, and links to its website or portals.
- Generic greetings (e.g., “Dear User” instead of your name)
- Urgency or fear tactics (e.g., “Your account will be deactivated!”)
- Suspicious links or attachments
- Requests for sensitive data (passwords, bank details, addresses, etc.)
What to Do If You Think You’ve Fallen for a Phishing Scam
If You Clicked a Suspicious Link or Opened an Attachment
- Update your computer’s security software
- Run a full system scan and delete anything the scan flags as a threat
If You Shared Sensitive Information
- If you gave out your Social Security number, credit card, or bank account info, go to IdentityTheft.gov for tailored recovery steps.
- If you shared your username and password, change the password immediately.
- Use a strong, unique password.
- If you use the same password on other accounts, change those as well.
FTC-Recommended Business Protection Strategies
From the Federal Trade Commission (FTC), here are best practices to protect yourself, your law firm and your staff:
- Use Email Authentication
Ensure your business email system uses authentication protocols like SPF, DKIM, and DMARC. These prevent attackers from sending emails that appear to come from your domain. - Keep Security Systems Updated
Always install the latest updates and patches. Use intrusion prevention tools to monitor for unusual network activity. - Train Your Staff
Educate your team regularly on phishing tactics. Show them real-world examples and provide tips during onboarding and ongoing training sessions.
What To Do If Your Email Is Spoofed
- Report the incident to the FTC at FTC.gov/Complaint. (The Bar submitted a report following yesterday’s incident.)
- Notify your clients/customers quickly — without using clickable links — via email, mail, or social media.
- Alert your internal team and use the event as a training opportunity to reinforce cybersecurity best practices.
Stay Safe, Stay Vigilant
The Utah State Bar is committed to keeping its licensees informed and protected. We will continue to provide updates and resources to help you stay ahead of emerging threats.
If you think your personal information has been compromised, go to IdentityTheft.gov for specific next steps. Learn more about impersonation scams at ftc.gov/impersonators.
Reminder: The FTC will never demand money, threaten you, request wire transfers, or promise prizes.
For information about all types of scams and how to recover from them, visit ftc.gov/scams.
General scam and consumer protection advice is also available at consumer.ftc.gov.
For more cybersecurity support and verified service providers, visit: utahbar.org/business-partners