A €150,000 Payment to the Wrong Account

Background

In early 2023, a specialty pharmaceutical company working on treatments for nutritional deficiencies had an employee's email account broken into. The attackers used it to steal €150,000 from one of the company's clients.

The Problem

Once inside the account, the attackers posed as the employee and emailed a client about a pending payment. They pointed the client at a website showing fake payment instructions. The client had no reason to doubt an email from an address it already knew, and transferred €150,000 to a Portuguese bank account opened under a false name.

The money was then moved on through several international accounts, which made recovering it far harder.

Market Context

The company deals daily with clients, resellers, researchers and suppliers, exchanging confidential information and large payments by email as a matter of routine. That makes its mailboxes valuable to an attacker, and it means a single compromised account damages both the client relationship and the company's standing with everyone else on the thread.

Risks to the Company

• Financial Losses: The client lost the €150,000, but the company was exposed too: legal action, compensation claims and higher insurance premiums all follow an incident like this.
• Reputational Damage: Clients and partners who hear that payment instructions came out of the company's own mailbox start checking everything twice, and some take their business elsewhere.
• Operational Disruptions: Investigating the breach, fixing what let it happen and briefing everyone affected takes senior people away from the business for weeks.

The Solution

To stop the same thing happening again, the company brought in DefendDomain:

• Continuous monitoring: Domain registrations watched in real time, so a site set up to host fake payment instructions is spotted while it is still being built.
• Alerts on detection: The security team hears about a suspicious domain when it appears, not when a client calls to ask why a payment bounced.
• Takedown handled for them: The case-building and the chase with registrars and hosting providers is done by DefendDomain, which shortens the window an attacker has to work in.