Leoni AG, one of the world’s leading wire and cable manufacturers, fell victim to an email scam that cost the company 40 million euros. According to a press release, “Leoni AG realised on Friday 12 August 2016 that it had become the victim of fraudulent activity with the help of falsified documents and identities and the use of electronic communication channels. […] The damage amounts to an outflow of liquidity totalling around EUR 40 million.”
It all began with a spoofed email
According to Tripwire, a member of the finance department of Leoni AG’s Bistrita factory, located in Romania, received an email spoofed to look like it was sent from one of the German executives, ordering them to transfer 40 million euros to a foreign bank account. Although Leoni AG owns four factories in Romania, Bistrita is the only one authorised to make money transfers – showing that the cyber criminals investigated the company’s practices before launching the attack.
Business email compromise – common features
The attack that cost the company 40 million euros and a 2% drop in stock value is commonly known as ‘business email compromise’ (BEC) or whaling. Common features are:
- Thorough investigation of the target to maximise chances of success.
- Carefully crafting a replica of the internal email layouts – the more authentic it looks, the less likely it is to generate suspicion.
- Spoofing top-level staff email addresses.
- Targeting key employees authorised to make money transfers.
Give your staff a heads-up about email scams
Nowadays, email scams are a common plague affecting all organisations – 9 in 10 cyber attacks begin with email, according to Mimecast. The more your staff know about phishing and social engineering attacks, the more vigilant they are and the more secure your company is. The Phishing Staff Awareness Course has been specially developed for this purpose. Delivered online, and packed with real-life examples, non-technical explanations of what phishing attacks are and best practices to recognise them, your staff will get invaluable information to safeguard your company’s security.
Minimise the impact of phishing attacks. Enrol your staff on the phishing staff awareness course >>
Furthermore, you can test your employees’ vulnerability to phishing attacks with the Simulated Phishing Attack. Our ethical hackers will perform a spear-phishing attack enabling you to assess your employees’ awareness of phishing attacks and take remedial action.
