{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2018-cinema-group-pathe-loses-eur-19-2-million-to-ceo-fraud-dutch-executives"},"incident":{"slug":"2018-cinema-group-pathe-loses-eur-19-2-million-to-ceo-fraud-dutch-executives","title":"Cinema group Pathe loses EUR 19.2 million to CEO fraud; Dutch executives dismissed","date":"2018-03","date_precision":"month","year":2018,"victim_org":"Pathe (Pathe Nederland)","sector":"Media & Entertainment","country":"Netherlands","primary_vector":"Business Email Compromise","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":21500000,"loss_kind":"direct_loss","loss_note":"EUR 19.2 million (about US$21.5 million at the time). A Dutch court later upheld the dismissal of the executives involved.","records_affected":null,"threat_actor":null,"summary":"Between March and May 2018 the Dutch arm of the French cinema chain Pathe transferred about EUR 19.2 million in a series of payments to accounts in Dubai, acting on emails purporting to come from Pathe's French head office. The company dismissed the managing director and financial director of Pathe Nederland; a Dutch court ruling later published details of the case and upheld the dismissals.","how_it_worked":"Emails presented as coming from Pathe's headquarters in France told the Dutch leadership that the group was making a confidential acquisition in Dubai and needed funds released quickly, with strict instructions not to discuss it internally because of regulatory sensitivity. The correspondence adopted the tone and structure of genuine group communications and continued over weeks, with follow-up messages managing the executives' doubts as the sums grew. The confidentiality clause was the key mechanism: it explained away every anomaly and stopped the one action, a phone call to Paris, that would have ended the fraud immediately.","lessons":"Any instruction whose own terms forbid verification should be treated as fraudulent by default; secrecy is the tell, not the credential.","confidence":"Confirmed","sources":[{"title":"Details of Pathe Nederland's EUR 19.2M Loss to CEO-fraud Revealed","url":"https://celluloidjunkie.com/2018/11/12/details-of-pathe-nederlands-e19-2m-loss-to-ceo-fraud-revealed/","publisher":"Celluloid Junkie"},{"title":"Dutch Film Boss Sacked After EUR 19m BEC Loss","url":"https://www.infosecurity-magazine.com/news/dutch-film-boss-sacked-after-19m/","publisher":"Infosecurity Magazine"}],"entry_type":"incident","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2018-cinema-group-pathe-loses-eur-19-2-million-to-ceo-fraud-dutch-executives"}}