Pune-Headquartered Engineering Company Defrauded By A “Man-In-The-Middle” Cyber Attack

A Pune-based multinational engineering company was tricked and lost 56,000 euros i.e. more than Rs 50 Lakh via a cyber attack in which officials of the company becomes victim via fraudulent emails termed as the “man-in-the-middle” cyber attack.

A “man-in-the-middle” cyber attack generally takes place in a business transaction where email accounts of either both or one company are hacked. In such attacks, the hackers gain information about the business by hacking into email accounts of involved parties, then creating a similar email like one the company’s mail address. Using this similar created email account, hackers trick one of the parties by telling them that their company’s email is no longer functional and the company should deposit the amount in a different account (the hacker’s account) due to technical issues.

An FIR was filled at Pimpri Police Station on Tuesday which led to a further inquiry done by Pimpri Chinchwad Cyber Crime Cell. The cyberattack happened in August, September 2020 when an ongoing transaction was going to happen between a Germany company and this Pune-based Company.

It is suspected that the attackers could have acquired knowledge of the business dealings of the companies involved by hacking into the Germany company’s email account. Police also believes that the attackers may have created a closely similar-looking fake email account similar to that of the Germany company from which the hackers would have taken over the conversation about the business deal.

The attackers as Germany company then informed the Pune-based company that the account details were changed due to some technical issues and asked them to transfer the amount of 56,450 Euros into the account belonging to the hackers. The complaint was filed as soon as the company officials realized that they had made the transaction to the wrong account. The case was registered under the Penal Code section 420 – cheating and Information Technology Act. The Police claim to have launched a detailed investigation on the email accounts and the account details used by the attackers.

It’s not the first time that a company from Pune has been the victim of a “man-in-the-middle” attack, in 2019 more than three cases were registered in just six months in which companies lost thousands of dollars to attackers.

It is believed that such an attack takes place and is possible when the company’s security features regarding the email accounts are not updated regularly. Another reason for such successful attacks is due to lack of communication and emailing being used as the communication mode.

The Police issued a Five-Point Advisory last year which states that:

• The security features of the company’s email address and mailing system should be checked and updated regularly. Digital signatures can be added to email communications.
• The accounting staff of the company should be trained about various cyber frauds. It has been observed that the lack of awareness among staff is the key factor when companies fall prey to such attacks.
• When a company asks to send money to a different account than the usual, the new details should be confirmed through a direct or telephonic conversation with authorized personnel.
• While dealing with business entities through the mail addresses, the authenticity of the domain names should be meticulously checked.
• In case of cheating, the Cyber Crime Cell should be immediately contacted.

If you like this article, follow us on Twitter, Facebook, Instagram, and Linkedin.