Business Email Compromise Response



An engineering firm becomes the victim of a business email compromise attack and requested a full forensic investigation so they can pursue a lawsuit against its bank.


HKA’s cybersecurity and privacy experts were engaged to assist a client with a business email compromise attack that led to multiple unauthorized wire transfers totaling more than US $4 million.

What we did

HKA’s cybersecurity and privacy team dispatched an expert to respond to the client’s business email compromise and provide a digital forensic investigation of the incident.

HKA’s expert was given access to the client’s email environment so logs from its Office 365 and Microsoft Azure environments could be captured and examined. A forensic copy of the suspected user’s mailbox was made, providing increased access for our expert.

Additionally, HKA’s expert restored deleted correspondence and cross-referenced internal communication to document the activity of the attackers.

Finally, our expert generated a report not only detailing the activity of the attackers, but also supporting the client’s assertions that bank process failures contributed to the unauthorized transfer of funds. The engagement will continue in litigation.


HKA’s digital forensic investigator validated the security of the client’s environment and provided the client with the necessary support to enter into litigation and sue the bank for US $4 million.

Project Details
  • Client
    Engineering Firm
  • Year
  • Value
  • Services
    Incident Response
  • Sectors
    Cybersecurity & Privacy Risk Management