I'm an ICAS member and this morning received an email saying an investigation had been opened on me. This email came from a genuine ICAS email address and included my Firm Name, Office Address and Office Number. Interestingly ICAS's details of my firm name include the trading name in brackets, which is exactly how proper correspondence from ICAS comes.
So it looked genuine and worrying about the investigation but there is a Word file with Macros attached that looked suspicious. I just phoned ICAS and they said a lot of spam has been sent from their email address and I should ignore it. Certainly a relief on the supposed investigation but I can only assume someone has hacked into ICAS servers successfully.