Cyber Incident Victim: Afognak Native Corporation
Date:
Apr 2015
Location:
United States of America
Summary
A subsidiary of Afognak Native Corporation lost $3.8 million in a fraudulent transfer orchestrated through a spoofed email impersonating the CEO, directing funds to a fictitious Hong Kong entity. Attackers, posing as legal representatives, exploited senior management's absence during a shareholder meeting to pressure a controller into executing the "urgent" transaction under demands for confidentiality. The corporation discovered the unauthorized transfer two days later, involving the FBI to freeze the offshore account and initiating investigations with law enforcement and private experts. While no data breach occurred and customer information remained secure, auditors reviewed internal protocols and an insurance claim was filed to address the financial impact.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 15, 2015, Afognak Native Corporation’s subsidiary Alutiiq LLC experienced a cyberfraud incident involving the unauthorized transfer of $3.8 million to an offshore bank account. The attack coincided with a shareholder meeting in Port Lions, during which senior management was absent from the Kodiak Island headquarters. Perpetrators created a Europe-based email account impersonating CEO Greg Hambright’s address and sent instructions to Alutiiq’s controller regarding a "confidential transaction." A co-conspirator posing as an attorney followed up with a phone call minutes later, urgently requesting the funds be sent to a fictitious Hong Kong-based entity. The controller, believing the request legitimate, executed the transfer under the attackers’ demands for strict confidentiality. Corporate systems remained uncompromised, with no breach of computer accounts or exposure of customer data.
The fraudulent transfer was discovered two days later on April 17 by Hambright and CFO Bill Zang. Afognak immediately notified its corporate bank and the FBI, which sought to freeze the Hong Kong account. The corporation engaged FBI investigators, law enforcement agencies, private investigators, and cybersecurity consultants to trace the attack’s origins—linked to Asia or Eastern Europe—and pursue prosecution. Afognak’s board of directors acknowledged the incident in an April 30 shareholder letter, expressing dismay while emphasizing efforts to recover funds "to the maximum extent possible under law." Auditors initiated a review of financial protocols, and an insurance claim was filed. No further financial losses or operational disruptions beyond the initial transfer were reported.