4 ms·

Does this mean an employees of the company got an email from someone posing as their boss, or their CEO, instructing them to wire $46 million dollars, and they

Does this mean an employees of the company got an email from someone posing as their boss, or their CEO, instructing them to wire $46 million dollars, and they simply...did so? without asking any questions?

pquerna 11y ago
Yes. Basically. I've seen similar attacks before, granted for lower amounts, but in many companies, finance departments sending out wires for many hundreds of thousands of dollars is a common operation -- suppliers, contracts signed, and everyone wants their wire transfer to be done ASAP. Get an email from the CFO/CEO/SVP of X saying to wire money for contract Z ASAP, and action will be taken.
- andor 11y ago
  Sounds like cryptographically signing emails is not such a bad idea after all...
  - chinathrow 11y ago
    Sounds like taking transfer orders via email at all is still a bad idea after all...
  - omouse 11y ago
    This is why Estonia's e-residency program focus on authentication and digital signing. It should be harder to steal a crypto key no?
  - roasty 11y ago
    Yeah, except it's also possible, and not unusual, to compromise the cfo or someone's email/computer and then send signed emails all day.
- booop 11y ago
  At my company any email request like that is verified by a phone call. (Don't know if that would have helped here).
55555 11y ago
It was likely multiple smaller wires, but yes, that's basically what happened. Big companies wire a lot of money a lot of places.
njharman 11y ago
That makes it sound strange. The reality is the finance dept responded to routine requests for wire transfers similar to all the others the handle all day, every day.
omouse 11y ago
It's usually a finance dept person who gets an email like this and yes it's a possibility. A CEO/boss sounds like they're in charge and it's sometimes very difficult to question orders. I heard a story that at one place the only reason they didn't scammed is because the accountant walked over to the CEO to double-check the instructions of the wire transfer. It's easy to imagine what would have happened if the wire transfer instructions were correct!

pquerna 11y ago

Yes. Basically. I've seen similar attacks before, granted for lower amounts, but in many companies, finance departments sending out wires for many hundreds of thousands of dollars is a common operation -- suppliers, contracts signed, and everyone wants their wire transfer to be done ASAP. Get an email from the CFO/CEO/SVP of X saying to wire money for contract Z ASAP, and action will be taken.

andor 11y ago
Sounds like cryptographically signing emails is not such a bad idea after all...
- chinathrow 11y ago
  Sounds like taking transfer orders via email at all is still a bad idea after all...
- omouse 11y ago
  This is why Estonia's e-residency program focus on authentication and digital signing. It should be harder to steal a crypto key no?
- roasty 11y ago
  Yeah, except it's also possible, and not unusual, to compromise the cfo or someone's email/computer and then send signed emails all day.
booop 11y ago
At my company any email request like that is verified by a phone call. (Don't know if that would have helped here).

55555 11y ago

It was likely multiple smaller wires, but yes, that's basically what happened. Big companies wire a lot of money a lot of places.

njharman 11y ago

That makes it sound strange. The reality is the finance dept responded to routine requests for wire transfers similar to all the others the handle all day, every day.

omouse 11y ago

It's usually a finance dept person who gets an email like this and yes it's a possibility. A CEO/boss sounds like they're in charge and it's sometimes very difficult to question orders. I heard a story that at one place the only reason they didn't scammed is because the accountant walked over to the CEO to double-check the instructions of the wire transfer. It's easy to imagine what would have happened if the wire transfer instructions were correct!