{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2021-one-treasure-island-nonprofit-loses-650-000-to-hijacked-email-thread"},"incident":{"title":"One Treasure Island nonprofit loses $650,000 to hijacked email thread","date":"2021","date_precision":"year","victim_org":"One Treasure Island","sector":"Nonprofit","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Vendor / Supply Chain Impersonation"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":650000,"loss_note":"$650,000 diverted. Funds initially landed at a bank in Odessa, Texas; the nonprofit reported difficulty obtaining law enforcement and bank assistance and no recovery was confirmed in the cited reporting.","records_affected":null,"threat_actor":null,"summary":"One Treasure Island, a San Francisco nonprofit serving low-income residents, lost $650,000 after criminals compromised its bookkeeper's email account, inserted themselves into an existing email thread and requested a change to wire instructions for a grant payment. Executive director Sherry Williams pursued the funds herself, contacting the receiving bank in Odessa, Texas and seeking help from senators before the Secret Service opened an inquiry.","how_it_worked":"The attackers took over the outsourced bookkeeper's mailbox, which sat at the center of the nonprofit's payment approvals, and then replied inside a live thread about a pending grant disbursement rather than starting fresh correspondence. Because the message carried the real address, the real subject line and the real transaction context, the substituted wiring instructions read as an ordinary administrative update. Staff sent the $650,000 grant payment to the criminals' account at a small out-of-state bank, which was then drained onward. The organization discovered the diversion only when the intended recipient reported non-receipt, and small-nonprofit resourcing left it largely on its own to chase the money.","lessons":"Thread hijacking beats sender-address checks, so any change of wire instructions inside an existing thread must trigger a verbal callback to a previously known number before funds move.","confidence":"Reported","sources":[{"title":"Scammed San Francisco Nonprofit Falls Victim to Costliest Type of Cybercrime","url":"https://www.cbsnews.com/sanfrancisco/news/scammed-san-francisco-nonprofit-falls-victim-to-costliest-type-of-cybercrime/","publisher":"CBS News Bay Area / Associated Press"},{"title":"A nonprofit that helps the poor lost $650,000 to scammers","url":"https://www.sfchronicle.com/crime/article/S-F-nonprofit-lost-650-000-to-hackers-and-a-16191669.php","publisher":"San Francisco Chronicle"}],"entry_type":"incident","slug":"2021-one-treasure-island-nonprofit-loses-650-000-to-hijacked-email-thread","year":2021,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2021-one-treasure-island-nonprofit-loses-650-000-to-hijacked-email-thread"}}