{"id":1460,"date":"2026-08-31T20:04:48","date_gmt":"2026-09-01T01:04:48","guid":{"rendered":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/?p=1460"},"modified":"2026-08-31T20:08:29","modified_gmt":"2026-09-01T01:08:29","slug":"aging-report-bec-scam-las-vegas","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/blog\/aging-report-bec-scam-las-vegas\/","title":{"rendered":"Aging-Report BEC Scam Hits 42,000 Companies | Las Vegas"},"content":{"rendered":"
Cybersecurity Alert<\/span><\/p>\n

The Aging-Report Scam: How a 3-Hour Attack Hit 42,000 Companies<\/h2>\n

A single automated campaign reached 67,000 people at 42,000 organizations in under three hours flat. No malware, no malicious links — just a well-timed email and a request that sounded routine. Las Vegas businesses without payment-verification controls are exactly the target it was built for.<\/p>\n

Published by CMIT Solutions of Las Vegas \u00b7 Cybersecurity \u00b7 7 min read<\/p>\n<\/div>\n

What Happened: A Business Email Compromise Campaign at Industrial Scale<\/h2>\n

On June 1, 2026, Microsoft’s Defender Research team caught something unusual moving through inboxes across the United States. Between 2:08 p.m. and 4:52 p.m. UTC — a window of less than three hours — an automated business email compromise (BEC)<\/strong> operation reached more than 67,000 people at over 42,000 organizations, almost entirely inside the U.S. There was no ransomware payload, no malicious attachment, and no link for a spam filter to flag. Just email, sent at a volume and speed that only automation can produce.<\/p>\n

The targeting wasn’t limited to one industry. Retail and consumer goods companies made up 17% of the organizations hit, technology and software firms 15%, and financial services 14% — with the remainder spread across dozens of other sectors, including the professional services, hospitality, and healthcare businesses that make up much of the Las Vegas economy. The campaign used three lure types to open the conversation: impersonated executive messages, requests for an “aging report” (the internal finance document that lists which invoices are overdue and from whom), and payroll-diversion requests aimed at HR and finance staff.<\/p>\n

By The Numbers<\/span>
\nMicrosoft logged 7.6 billion email-based phishing threats across Q2 2026 alone. The June 1 BEC blitz reached 42,000 organizations in under three hours — and unlike a typical phishing email, it carried no attachment or link for a security filter to catch.<\/em><\/div>\n

This wasn’t an isolated blip. Microsoft’s own Q2 2026 threat report puts the June 1 blitz inside a much bigger pattern: 7.6 billion phishing emails detected across April, May, and June alone, with monthly volume actually declining slightly even as individual campaigns grow more automated and more convincing. In other words, attackers are sending fewer emails overall but engineering each wave to convert at a far higher rate — and a three-hour campaign that hits 42,000 organizations without tripping a single malware filter is exactly what that shift looks like in practice.<\/p>\n

Why This Attack Works: Inside the Aging-Report Scam<\/h2>\n

Most email security tools are built to catch malware and malicious links. This campaign used neither. That’s what makes the aging-report angle so effective — it’s a social engineering play dressed up as a routine finance request, and it slides past the filters most Las Vegas businesses rely on as their only line of defense. The sender address is often a lookalike domain, one or two characters off from the real vendor or executive’s address, close enough that a busy accounts-payable clerk won’t catch it on a quick read.<\/p>\n