Email with weirdly personal details - is this spam?

Post date: 2020-01-15 17:59:56

I received an email at work with very specific accusations and no clickable links. It came from a gmail account. I reported it to work's cybersecurity and they indicated it's spam and blocked the sender but the details were so weirdly specific that I'm concerned. What would be the purpose of this?

I got an email this morning accusing me of having a conflict of interest with one of my staff because I have worked with them at a previous organisation. It claimed a bunch of petty stuff like they are frequently late and that I give them extra leave, none of which is true. When we recruited, we followed procedure, with candidates making application externally, being interviewed by a panel, etc. I disclosed our previous work relationship to my manager and other interview panel members at the time.

I would have just dismissed this as ridiculous spam except that:

A)It included the name of the previous organisation where we worked together
B)It used the specific term "you poached employee]" - and I often jokingly use the word "poached" to refer to this staff member as it isn't a secret that we've worked together previously.
C)My workplace is a large organisation and our division is currently going through a restructure which has turned nasty. My role and employee's role are not under threat but others are.

If it's not spam, it could be a malicious email from someone in our organisation, which is much more of a worry. Employee has proven useful and is valued and (as far as I know) gets on well with everyone. However this is a very stressful time for everyone, feelings are running high and people who aren't feeling appreciated in their roles might be resentful of those who are.

I asked our cybersecurity team if they'd seen this kind of thing before and got a vague reply that this kind of thing from gmail is usually spam. But I can't think what it would achieve since there were no clickable links. Were they just waiting for me to engage before deploying, or something? Have you seen examples of this kind of spam before?

Please click Here to read the full story.