Media giant Nikkei has become the latest firm to suffer a humiliating Business Email Compromise (BEC), after it admitted losing $29m to scammers following human error.
The Tokyo-headquartered firm, which owns the Financial Times, revealed in a brief statement that an employee of its US subsidiary made the crucial mistake.
“In late September 2019, an employee of Nikkei America, Inc. … transferred approximately $29m Nikkei America funds based on fraudulent instructions by a malicious third party who purported to be a management executive of Nikkei,” it noted.
“Shortly after, Nikkei America recognized that it was likely that it had been subject to a fraud, and Nikkei America immediately retained lawyers to confirm the underlying facts while filing a damage report with the investigation authorities in the US and Hong Kong. Currently, we are taking immediate measures to preserve and recover the funds that have been transferred, and taking measures to fully cooperate with the investigations.”
Nikkei follows a long line of big-name organizations which have been caught out over recent months and years.
Most notably, tech giants Facebook and Google were both tricked into making huge money transfers, of $99m and $23m respectively — although those attacks appear to have been more sophisticated than the one affecting Nikkei.
BEC scammers are also looking to take a leaf out of the ransomware playbook by targeting US municipalities.
The City of Ocala in Florida is said to have lost $742,000 after an official was tricked by a spear-phishing email. The message was sent by an attacker posing as an employee of a building firm the authority is currently using to construct an airport terminal.
When the real construction company complained that an invoice had not been paid, the alarm was raised, according to local reports.
BEC cost global organizations $1.3bn last year, almost half of total losses reported to the FBI.