{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2018-pathe-dutch-branch-wires-19-million-in-fake-ceo-acquisition-scam"},"incident":{"title":"Pathé Dutch branch wires €19 million in fake CEO acquisition scam","date":"2018-03","date_precision":"month","victim_org":"Pathé (Netherlands branch)","sector":"Media & Entertainment","country":"Netherlands","primary_vector":"Business Email Compromise","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":21500000,"loss_note":"More than €19 million (about $21.5 million) paid in multiple transfers, including from the Pathé group cash pool in France. Recovery not publicly confirmed.","records_affected":null,"threat_actor":null,"summary":"In March 2018 fraudsters impersonating the chief executive of French film company Pathé's parent persuaded the Dutch branch's leadership to make a series of payments totaling more than €19 million for a purported acquisition of a Dubai-based company. Branch director Dertje Meijer and CFO Edwin Slutter were both dismissed after the loss surfaced. An external investigation cleared them of involvement, and Slutter later won partial relief in a wrongful-termination suit.","how_it_worked":"The attackers opened with a low-key question about a KPMG contact to establish a plausible thread, then escalated to a confidential acquisition of a Dubai entity, insisting that all communication run through a spoofed personal address 'as a security measure' for sensitive transactions. When the CFO asked for verification, the fraudsters produced a forged authorization email from the Pathé France manager complete with copied signatures and an invoice from the supposed Dubai target. The CFO checked the signatures, which matched, and payments proceeded from several sources including the group cash pool. Small inconsistencies in the correspondence were noticed but not escalated until headquarters queried the withdrawals.","lessons":"Document-based verification is not verification when the attacker supplies the documents; approval for cross-border deal payments must be confirmed by voice with named group officers on known numbers.","confidence":"Confirmed","sources":[{"title":"BEC scammers stole €19m from film company Pathé","url":"https://www.helpnetsecurity.com/2018/11/14/pathe-bec-scam/","publisher":"Help Net Security"}],"entry_type":"incident","slug":"2018-pathe-dutch-branch-wires-19-million-in-fake-ceo-acquisition-scam","year":2018,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2018-pathe-dutch-branch-wires-19-million-in-fake-ceo-acquisition-scam"}}