Case study · Business email compromise · Sydney
A managing director’s account, turned against the firm.
Staff at a Sydney financial advisory firm of about 110 people received payment instructions that appeared to come from the managing director. An attacker was in the director’s Microsoft 365 account. Three fraudulent payments totalling $96,000 were stopped.
Business
Financial advisory, about 110 staff
Location
Sydney, NSW
Incident
Executive account compromise and impersonation
Outcome
$96,000 in attempted fraud stopped; no loss
At a glance
The numbers
Client details are withheld. Figures are rounded where noted.
9 min
from the first email to a responder’s reply.
35 min
to secure the managing director’s account.
$96,000
in attempted fraudulent payments stopped, with no confirmed loss.
Timeline
Wednesday morning to findings
Wed morning
Several staff receive unusual payment instructions apparently from the managing director.
+9 minutes
An Authene responder replies with the first steps.
+35 minutes
The director’s account is secured.
Next
We review the 23 suspicious emails sent to internal and external recipients.
Within 48 hours
Findings delivered: six days of unauthorised access, and the full timeline.
What happened
The incident
An attacker had access to the managing director’s Microsoft 365 account for six days. They used it to send 23 suspicious emails, impersonating the director to start three payments.
The unusual requests to staff were the first sign.
What Authene did
The response
- Contained the affected account
- Investigated suspicious mailbox activity
- Established the compromise timeline
- Reviewed every message sent to internal and external recipients
Outcome
No money lost
All three attempted payments, totalling $96,000, were prevented, and there was no confirmed financial loss.
The review also showed exactly which internal and external recipients had received suspicious emails.
If this sounds familiar
What to do first
- If money may have moved, call your bank now and ask for a recall
- Don’t delete emails, files or accounts. They’re evidence
- Email response@authene.com.au. A responder replies within 15 minutes, 24/7/365
Related
Read more
Case study
Odd payment requests? Get in touch.
Email us and a responder will reply within 15 minutes, 24/7/365, across Australia and New Zealand.