I was recently helping a client in Tokyo respond to a serious
and sophisticated cyber breach where hackers executed a transfer of
nearly US$1M out of the client's Hong Kong bank account. In
this instance, the hackers had hacked into the CEO's
cloud-based corporate e-mail account and had determined a way to
create a transaction that his intermediary company believed to be
genuine. The hackers sat on top of the e-mail to intercept any
queries and assure colleagues that this was an authorized transfer.
The transaction was made on a Friday, in the hopes that it would
not be noticed until the following week. Indeed, our client only
realized that the transaction had happened on the following Monday,
when he received by mail hard copies of the transfer documents from
his intermediaries.
