Huntress Stops $103,000 BEC Scam After Vendor Email Accounts Are Compromised
Summary
Attackers used two compromised vendor email accounts to redirect a roughly $103,000 payment. Huntress stopped the transfer by calling to verify new bank details, and the vendor’s IT team investigated the compromise.
Key points
- Huntress initiated an ACH payment of about $103,000 to a vendor on August 4, 2023.
- An attacker using the vendor contact’s compromised email account asked Huntress to stop the payment and later sent new bank details.
- Huntress called the contact to verify the account change; she denied sending the emails, and the payment was stopped.
- The attackers continued emailing after the vendor shut down the contact’s account; a colleague copied on the exchange was also found to be compromised.
- The vendor’s IT team investigated, and Huntress reported the incident to Regions Bank.
- Huntress says its procedure of independently calling vendors to confirm new bank details, supported by security awareness training, prevented the transfer.
Article Details
- Victim Organization
- Huntress was targeted for a fraudulent payment; the compromised vendor was not named.
- Incident Type
- Business email compromise (BEC) involving compromised vendor email accounts, email impersonation, and attempted payment redirection to a fraudulent bank account.
- Incident Date
- 2023-08-07
- Disclosure Date
- 2023-08-09
- Operational Impact
- A payment of approximately $103,000 was initiated on August 4 and stopped before it was transferred. The vendor reported that two email accounts were compromised; the vendor's IT team shut down Darla's email account while investigating. The article does not report confirmed data exposure or theft.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed