Fraudsters steal nearly $47 million from Ubiquiti Networks
US networking technology company Ubiquiti Networks has been swindled by fraudsters and has lost nearly $47 million.
According to the quarterly financial report the company filed last week with the US Securities and Exchange Commission, they discovered that they have became a victim of a criminal fraud on June 5, 2015.
“The incident involved employee impersonation and fraudulent requests from an outside entity targeting the Company’s finance department. This fraud resulted in transfers of funds aggregating $46.7 million held by a Company subsidiary incorporated in Hong Kong to other overseas accounts held by third parties,” the report says.
Ubiquiti has been trying to recover the stolen money, and has so far managed to regain possession of $8.1 million, and believes it likely that they will recoup another $6.8 million.
“The Company is continuing to pursue the recovery of the remaining $31.8 million and is cooperating with US federal and numerous overseas law enforcement authorities who are actively pursuing a multi-agency criminal investigation,” they added.
The investigation by the Audit Committee of the company’s Board of Directors uncovered no evidence that the company’s systems were breached or that corporate information was accessed. There’s also no evidence that points to an employee being involved in the heist.
While the company attempts to recover the stolen funds, they have also implemented “enhanced internal controls over financial reporting”, and additional procedures and controls in order to prevent such a thing happening to them again. Naturally, they didn’t publicly share what those procedures and controls are.
Brian Krebs thinks it likely that Ubiquity fell prey to the so-called Business E-mail Compromise (BEC) scam – a type of scam that FBI’s Internet Crime Complaint Center (IC3) warned about earlier this year and that netted scammers nearly $215 million in 14 months.
The BEC scam can take several forms, but the result is the same: stolen funds.
Business can take steps to avoid becoming victims. First and foremost, they should start using 2-step verification for confirm significant transactions, but choose different environments for each step (e.g. one confirmation can be done via email, and the other via a phone call).
Other things that could help are not sharing company/employee data (such as job description) on the company’s website, and being extra careful when there are sudden changes in business practices (e.g. a business contact switching from the company email to a personal one).