{"meta":{"database":"Global Social Engineering Impact Database","url":"https://global-social-engineering-impact-da.vercel.app","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","generated":"2026-08-29T09:20:54.742Z","total":1,"returned":1,"limit":50,"offset":0,"next":null,"note":"Read loss_kind before summing loss_usd: only direct_loss and ransom_paid are comparable. Entries with entry_type \"benchmark\" are aggregate agency statistics and overlap with everything else by construction."},"results":[{"title":"Scattered Canary floods Washington's pandemic unemployment system with fake claims","date":"2020-05","date_precision":"month","victim_org":"Washington State Employment Security Department","sector":"Government","country":"United States","primary_vector":"Credential Phishing Portal","secondary_vectors":["Business Email Compromise"],"ai_involvement":"No AI reported","ai_notes":"No AI involvement reported.","outcomes":["Wire Fraud / Financial Loss","Identity Theft"],"loss_usd":null,"loss_note":"Reported as hundreds of millions of dollars; the state had not determined a final figure at the time of reporting, and a substantial portion was later recovered.","records_affected":null,"threat_actor":"Scattered Canary (Nigeria-based fraud ring)","summary":"In May 2020 the Nigerian fraud group known as Scattered Canary filed thousands of fraudulent unemployment claims against Washington State's Employment Security Department during the pandemic claims surge. The group used personal data stolen in earlier breaches to impersonate real workers, and routed benefit payments to out-of-state accounts controlled by money mules. Reported losses ran to hundreds of millions of dollars before the state froze payments.","how_it_worked":"The ring assembled identity packages from earlier consumer data breaches, giving them the Social Security numbers, dates of birth and addresses of real Washington workers. They registered claims using disposable email services and Gmail address variations so that a single controlled inbox could receive correspondence for many claimants, and they targeted the enhanced $600 weekly federal supplement, which raised the payout per fraudulent claim. Benefit payments were then directed to out-of-state bank accounts held by recruited mules. The pretext succeeded because the agency, overwhelmed by unprecedented claim volume, had relaxed verification to speed payments.","lessons":"Identity proofing and cross-matching against employer wage records must not be suspended under surge conditions; duplicate-contact and out-of-state-payee detection would have surfaced the ring early.","confidence":"Reported","sources":[{"title":"How missed 'red flags' helped Nigerian fraud ring 'Scattered Canary' bilk Washington's unemployment system amid coronavirus chaos","url":"https://www.spokesman.com/stories/2020/may/25/how-missed-red-flags-helped-nigerian-fraud-ring-sc/","publisher":"The Spokesman-Review / The Seattle Times"}],"entry_type":"incident","slug":"2020-scattered-canary-floods-washington-s-pandemic-unemployment-system-with-f","year":2020,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2020-scattered-canary-floods-washington-s-pandemic-unemployment-system-with-f"}]}