Cyber Incident Victim: Ybbstaler Unternehmen
Date:
Jan 2024
Location:
Austria
Summary
A Ybbstaler company fell victim to a cyberattack where unidentified threat actors compromised its email account through unauthorized access originating from French IP addresses. The attackers subsequently sent a fraudulent payment request from the hijacked account to a business client, manipulating banking details by providing a false IBAN. The deceived customer transferred approximately €95,000 in outstanding invoice payments to the specified Portuguese account, resulting in the full financial loss.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early January 2024, unidentified threat actors compromised the email account of a company based in Austria's Ybbstal region. The attackers repeatedly accessed the account using IP addresses traced to France, though the specific method of initial compromise remained unspecified in available reports. After establishing control, the perpetrators crafted and sent a fraudulent payment request email from the hijacked account to one of the company’s business clients. This deceptive communication replicated legitimate billing correspondence but contained manipulated banking details, specifically a falsified International Bank Account Number (IBAN). The recipient, interpreting the message as authentic, processed the payment for an outstanding invoice as instructed. Funds totaling approximately 95,000 euros were transferred to an account in Portugal before the deception was discovered.
The fraudulent transaction resulted in a confirmed financial loss of 95,000 euros for the Ybbstal-based company, with no public indication of fund recovery at the time of reporting. Law enforcement documented the incident as a business email compromise attack involving international infrastructure, noting the French IP addresses and Portuguese destination account as investigative focal points. The attack directly impacted the company’s accounts receivable operations and eroded trust in its email-based financial communications with clients. Public disclosures did not specify whether internal security audits followed the incident or whether additional vulnerabilities beyond the compromised email account were identified. The case underscored the operational risks associated with business email systems being exploited for cross-border financial fraud.