Fake payment instruction: Company, Switzerland 2024
After a phishing attack on a business email account, attackers set up forwarding rules and registered similar-looking domains ending in «.cam» for the company and several customers.
- Incident · 12.2024 · Switzerland
- Evidence: confirmed by an authority
- Fake payment instruction
- Phishing
As of
What happened
This allowed them to insert themselves into the communication between the company and its customers; the NCSC probably attributes the case to industrial espionage. Greater harm was averted.
- Affected
- Company (anonymous)
- Industry
- other industry
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Phishing email for the email password
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
CEO fraud, diverted payment, fake invoice
Mostly add-on 5 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Check forwarding rules in the mailbox regularly and protect email accounts with two-factor authentication.
Sources
- Wochenrückblick Woche 50: Spionieren im geschäftlichen E-Mail-Verkehr (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 17.12.2024
«So konnte auch im gemeldeten Fall grösseres Unheil abgewendet werden.»