Reference no: EM133255353
Case Study:
The CEO of a boutique hotel realized their business had become the victim of wire fraud when the bookkeeper began to receive insufficient fund notifications for regularly recurring bills. A review of the accounting records exposed a serious problem. At some point a few weeks before, the CEO had clicked on a link in an email that they thought was from the IRS. It wasn't. When they clicked the link and entered their credentials, the cyber criminals captured the CEO's login information, giving them full access to intimate business and personal details.
Attack Type:
Social engineering, phishing attack.
Response:
The hotel's cash reserves were depleted. The fraudulent transfers amounted to more than $1 million. The hotel also contacted a cybersecurity firm to help them mitigate the risk of a repeat attack.
Impact:
The business lost $1 million to an account in China. The funds were not recovered.
Lessons Learned:
Teach staff about the dangers of clicking on unsolicited email links and attachments, and the need to stay alert for warning signs of fraudulent emails. Engage in regular email security training.
Implement stringent wire transfer protocols and include a secondary form of validation.
Have a cyber incident response plan ready to implement!
Questions:
Knowing how the firm responded, what would you have done differently?
What are some steps you think the firm could have taken to prevent this incident?
How would you advise other businesses to reduce the risk of it happening to them?