Finance
“Incidents of ICS (calendar file) phishing were up approximately 33,000% between May and September, according to cybersecurity firm Sublime.”
Plain restatementAn email security vendor, Sublime Security, reported that calendar invite (.ics) phishing attacks rose by roughly 33,000 percent from May 2026 to September 2026.
General information only - not financial advice.
This number is real and correctly credited to Sublime Security, but two things were lost in the retelling. First, Sublime called it a projection, not a measurement. The company published the figure on September 17, 2026, with only the first half of September counted, and no confirmed final September number has appeared since. Second, the count covers attacks detected on Sublime's own email security platform across its customers, not calendar phishing worldwide, a limit that some coverage of the same report stated plainly. Sublime also published no absolute attack counts, so a rise of about 330 times cannot be checked against a starting point, and the monthly percentages it printed do not actually multiply out to 33,000 percent under any single consistent reading. The broader point behind the post is separately documented: calendar invites can land on a calendar even when the matching email is filtered to junk, and Google noted in a June advisory that it had investigated fake renewal notices sent through Calendar invitations. The trend is real; the specific headline figure is a vendor projection presented as a finished count.
[drifted from the evidence:] Incidents of ICS (calendar [drifted from the evidence:] file) phishing [drifted from the evidence:] were up approximately 33,000% [drifted from the evidence:] between May [drifted from the evidence:] and September, according to [drifted from the evidence:] cybersecurity firm Sublime.
[added by the neutral restatement:] An email security vendor, Sublime Security, reported that calendar [added by the neutral restatement:] invite (.ics) phishing [added by the neutral restatement:] attacks rose by roughly 33,000 [added by the neutral restatement:] percent from May [added by the neutral restatement:] 2026 to [added by the neutral restatement:] September 2026.
Red-tinted words in the claim drifted from the evidence. Green-tinted words are what a neutral restatement needs.
The trace / claim to source
- Sublime Security did publish a figure of approximately 33,000 percent for the change in calendar based attacks between May and September 2026, and the post attributes it to the right firm.
- The window named in the post, May to September, matches the window in the source.
- The underlying trend is documented in the vendor's own month by month figures, which show increases every month from May through September 2026 and the largest jumps in August and September.
- The mechanism described around the number is consistent with the source. Calendar invites are still created even if the email message is blocked by a secure email gateway or routed to the Junk folder, which is why the attack reaches targets that email filtering alone would stop.
- The attack type is corroborated beyond the vendor. Google acknowledged investigating fake renewal notices embedded directly in Calendar invitations in its June fraud and scams advisory.
- The post says incidents "were up" approximately 33,000 percent, a completed past measurement. The source says the increase "is projected to be" that, written on September 17 with only the first half of September counted. No confirmed September actual has been published since, so the figure presented as a measured outcome remains an extrapolation from half a month of data.
- "incidents of ICS phishing were up" reads as a statement about the phenomenon at large. The number counts only attacks detected on one vendor's platform across its own customers. One outlet covering the same report made this limit explicit, noting the figure reflects what Sublime observed rather than worldwide attack volume.
- No absolute counts accompany the percentage anywhere in the source. A 33,000 percent rise is a factor of about 330, and without the May starting count a reader cannot tell whether that is a move from a handful of detections to a few thousand or something far larger. Percentage changes off an undisclosed and apparently small base carry very different meaning at different bases.
- Whether the actual September 2026 figure matched the projection. The vendor has not published a confirmation, and searches of its blog and news pages through October 2026 found no follow up with final counts.
- How the ~33,000 percent headline was derived. The published monthly percentages do not compound to that number under either consistent reading of "X% over," and the gap is an order of magnitude, not rounding. Without absolute counts the headline cannot be reproduced from the data shown.
- How much of the rise reflects more attacks versus improved or newly deployed detection for this attack type over the same period. The source does not address whether detection coverage changed between May and September.
- The claim in the surrounding caption that AI agents accepted some of these invites on workers' behalf is attributed to Sublime by Morning Brew, but no Sublime publication stating it was located in this check. That element is uninvestigated beyond the secondary attribution.
The figure exists and is correctly attributed. Sublime Security published it on September 17, 2026, reporting month over month changes in calendar based attacks observed on its own detection platform: 282% in June over May, 338% in July over June, 1,216% in August over July, 1,426% in the first half of September over the full month of August, and a projected 2,852% for September over August. The decisive sentence reads: "the increase from May to September is projected to be ~33,000%." The word "projected" is the vendor's own. The post was published on September 17, with only the first half of September measured. Sublime framed the August and September jumps as the point at which the attack type reached the mainstream. One consumer outlet stated the scope limit directly: the company said calendar based attacks it observed rose 1,216% in August compared with July, and that figure reflects Sublime's observations rather than a measurement of all attacks worldwide. Another noted that the company projected a 2,852% increase for September overall, but it has not confirmed that estimate. I found no later Sublime publication confirming final September counts. No absolute number of attacks was published at any point in the series.
Complete reasoning
The reply is formatted for pasting into the thread where the claim is circulating.
Ask this case
Answers come only from the case file above; nothing is added.
Did calendar phishing attacks really jump by about 33,000 percent?
Sublime Security published that figure, but it labeled it a projection, not a confirmed measurement. The post was written on September 17, 2026, with only half of September's data counted, and no final confirmed number has appeared since.
Does the 33,000 percent figure cover all calendar phishing attacks worldwide?
No. It only reflects attacks detected on Sublime Security's own platform across its customers, not a global count. One outlet covering the same report stated this limit directly.
Can the 33,000 percent increase be checked against actual attack numbers?
No. Sublime never published absolute attack counts, only percentages. Without a starting number, there is no way to know if the rise went from a handful of detections to a few thousand or something much larger.
Is the underlying trend of rising calendar invite phishing real?
Yes. Sublime's own month by month figures show increases every month from May through September 2026, with the largest jumps in August and September, and Google separately noted investigating fake renewal scams sent through Calendar invitations in June.
Were AI agents accepting these calendar invites on workers' behalf?
That detail appeared in secondary coverage attributed to Sublime, but no Sublime publication stating it was found during this investigation, so it remains unconfirmed.