Nordstrom's email system abused to send crypto scams to customers

**Executive summary:** Customers of Nordstrom received fraudulent St. Patrick’s Day emails sent from an official [email protected] address promising to double crypto deposits; the company warned the messages were unauthorized and reporting ties the incident to an Okta SSO compromise leading to misuse of Salesforce Marketing Cloud, with attackers collecting ~ $5,600 in cryptocurrency so far.