Last year, international corporation Leoni AG admitted something that no company ever wants to: they were fleeced out of $44 million. The cause of this massive mistake is a familiar one – business email compromise, or “CEO fraud.” This method involves hackers using sophisticated social engineering strategies to entice employees to transfer funds for supposedly legitimate means.
How do these cybercriminals get away with such a bold move? Via email spoofing – hackers imitate domain names (think commpanyname.com instead of companyname.com}, then comb social media, Linkedln, and online business directories to discern more detailed information about that company’s employees.
In Leoni’s case, a CFO at a factory in Bistrita, Romania, received a legitimate-looking message from what appeared to be a high-level executive at company headquarters in Germany. The hackers accumulated extensive intelligence on Leoni’s internal protocol for initiating and OK’ing wire transfers, probably gleaned through months of spying on Leoni’s emails and breaking down its hierarchical decision making process.
The hackers even knew that, of Leoni’s four facilities in Romania, only the site in Bistrita was approved to transfer money. Some reports say they may have even identified common days and times when the specific high-level executive whose email was spoofed would send financial transfer requests to the CFO in question, striving to have their fraudulent request look as real as possible. But could such an attack have been prevented?
Although it was far more sophisticated than the 17,000 or so other successful social engineering scams the FBI has identified, the Leoni hack could have been avoided. CMIT Solutions’ comprehensive network security includes cyber-threat awareness training for employees and ongoing re-education for executives. The good news? The five most common strategies we recommend are relatively easy to implement.
- Analyze domain and account names, subject lines, and email text that accompanies any financial request. This may seem like tedious work, but with employee training and cybersecurity education as a touchstone of your IT strategy, you can stop illicit emails before they wreak havoc
- Safeguard against spyware and malware by never clicking on any unrecognizable link. In most mail programs, hovering over a link will reveal the web address it points to – if you don’t recognize it, DON’T click on it
- Prevent ransomeware by never opening any attachment from a sender you aren’t expecting something from. PDFs, ZIP files, MP3s, WAV files … All it takes is one click for ransomware to infect systems and data
- Use enterprise-grade secure email hosting instead of free web-based services. When you’re faced with
a cyberattack, free is never cheap enough. Reliable business email offers built-in security that’s well
worth the cost - Flag suspicious messages as spam or junk to help firewalls and conte”nt filters. This will help your email program spot dangerous incoming messages and automatically re-route them to the appropriate folder
The bottom line? Business email compromise is on the rise – the FBI estimates more than $2.3 billion has been inadvertently handed over to hackers since 2014. To prevent your company from suffering a similar fate, contact CMIT Solutions today. We offer comprehensive, layered solutions that stay up-to-date with the changing cybersecurity landscape.
