Attack archive
Real email attacks, 2021 to 2026
This archive holds 25 documented cases where email was the way in or the way the money moved. Each post says what the message looked like, why people acted on it, what it cost and how it came to light. Every fact links to a court filing, a regulator, the victim's own statement or a reputable newspaper.
Year by year
- 2026School districts and counties paid millions to fake vendors. Copilot spoke an attacker's alert.5 cases
- 2025Emails started giving orders to the AI assistants that read them. One phish poisoned npm packages used everywhere.4 cases
- 2024A deepfake call finished what an email started. Researchers showed an email could steer an AI assistant.4 cases
- 2023Links hid in QR codes, an exploit hid in an attachment, and criminals started selling AI to write the email.4 cases
- 2022The loudest breaches came by text and phone. Email kept emptying city accounts.4 cases
- 2021An Excel attachment shut down a national health service. Small towns paid invoices to strangers.4 cases
Every case
Newest first. A case is in the archive only when at least two independent sources document it. Where a famous attack did not start with an email, its year summary says so and leaves it out of this list.
2026
-
19 June to 23 October 2026
Pulaski County pays a jail contractor's bills to a stranger for months
One email in June 2026 changed where an Arkansas county paid its jail medical contractor. About $1.9 million went astray until the real firm asked why.
-
Discovered 4 August 2026, disclosed 6 August
IEH Corporation: a fake sharing link opens a defence supplier's mailbox
In August 2026 an employee of a US military supplier entered Microsoft 365 credentials on a fake page. The mailbox held engineering files.
-
17 December 2025, disclosed 27 April 2026
Pine Bluff schools wire $3.2 million after fake instructions join a real invoice thread
In December 2025 an Arkansas school district paid a construction invoice to the wrong account. The wiring instructions had been slipped into a genuine email thread.
-
Reported 23 January 2026, fixed by 11 March 2026
Copilot in Outlook shows a fake security alert written by an attacker
In 2026 a researcher showed that hidden text in an email could make Copilot's summary in Outlook show a fake security alert. Microsoft fixed it in March.
-
November 2025 to February 2026
Dickinson Public Schools pays nearly $5 million to a fake builder
Between November 2025 and February 2026 a North Dakota school district sent two construction payments to a fraudster's account. The FBI recovered the money.
2025
-
8 September 2025
One phishing email poisons npm packages with over 2 billion weekly downloads
In September 2025 a fake npm support email from npmjs.help took over the account of the maintainer of chalk and debug, and 18 packages were poisoned.
-
June to September 2025
Milwaukee sends $460,866 to a builder's .us twin, and gets it back
In 2025 an email from scherrerconstruction.us, not .com, changed where Milwaukee paid a library contractor. The bank held the money and police recovered it.
-
Published 10 July 2025
Hidden text turns a Gemini email summary into a fake security alert
In July 2025 a researcher showed that invisible text in an email could make Gemini's summary in Gmail warn of a hacked password and give a phone number to call.
-
Found January 2025, disclosed June 2025
EchoLeak: one unopened email could make Microsoft 365 Copilot leak data
In 2025 researchers showed that one email, never opened, could make Microsoft 365 Copilot send internal data to an attacker. Microsoft fixed it before any known abuse.
2024
-
From 22 October 2024
Midnight Blizzard mails signed remote-desktop files to thousands of officials
In October 2024 Midnight Blizzard sent spear-phishing emails with signed RDP attachments. Opening one connected the computer to the attackers' server.
-
Reported January and February 2024, disclosed August 2024
An email tells Microsoft 365 Copilot to search your inbox and hide the results in a link
In 2024 a researcher showed that hidden instructions in an email could make Copilot gather other mail and hide it in invisible characters inside a link.
-
March 2024, made public April 2025
CityHousing Hamilton pays $552,000 after the vendor had warned it to call first
In March 2024 a fake contractor email changed bank details. Two weeks earlier the real contractor had warned of a breach and asked to be called first.
-
January 2024, disclosed February 2024, Arup named in May
Arup: a doubted email, a deepfake video call and HK$200 million
In January 2024 a finance worker at Arup in Hong Kong doubted an email from the "UK finance chief". A video call full of deepfaked colleagues removed the doubt.
2023
-
14 September 2023, recovered January 2024
Fort Lauderdale pays $1.2 million to a fake police headquarters builder
In September 2023 the city paid a request that posed as the contractor building its new police headquarters. The paperwork looked right. Police later recovered the money.
-
May to August 2023
QR codes in fake Microsoft alerts flood a major US energy company
From May 2023 more than 1,000 emails carried QR codes that led to fake Microsoft 365 logins. About 29% of them went to one large US energy company.
-
Late May to June 2023, disclosed August 2023
New Haven schools pay $5.9 million to a fake school bus company
In 2023 attackers read a school manager's mailbox, then posed as the bus contractor. Six payments went out before the real company asked where its money was.
-
October 2022 to May 2023, disclosed 23 May 2023
Barracuda's email gateways hacked by the emails they were scanning
From October 2022 crafted attachments broke into Barracuda's email security gateways as they scanned them. Barracuda told customers to replace affected devices.
2022
-
13 and 14 October 2022, disclosed 1 November
Dropbox: a fake CircleCI login costs 130 code repositories
In October 2022 emails posing as CircleCI led Dropbox engineers to a fake login. The attacker used their GitHub access to copy 130 code repositories.
-
September 2022
Boulder County: a fake vendor says it was hacked and asks for new payment details
In September 2022 a fake vendor email redirected a $237,241.18 payment. The county got all of it back and now flags lookalike domains.
-
August 2022
Eagle Mountain, Utah: an impostor joins an email thread and takes $1.13 million
In August 2022 someone slipped into an ongoing email conversation about a major infrastructure project and persuaded the city to send one payment to the wrong account.
-
25 April 2022, announced 27 May
Portland pays $1.4 million to an impostor writing from inside its own mailbox
In April 2022 someone with access to a Portland Housing Bureau email account posed as a nonprofit builder and redirected a $1.4 million construction draw.
2021
-
18 October to 22 December 2021
Cottage Grove, Minnesota: three extra letters in a domain cost $1.28 million
In late 2021 an impostor wrote to the city as its sewer contractor's president, from a domain with "inc" added, and said the company had moved its banking.
-
9 July to 13 August 2021
Peterborough, New Hampshire loses $2.3 million to emails that copied its partners
In the summer of 2021 a town of about 7,000 people paid its school district and a bridge contractor into fraudsters' accounts after emails that imitated both.
-
January to May 2021, peaking on 25 May
Nobelium sends spear-phishing from a real USAID mailing account
In May 2021 the Russia-based Nobelium group took over a USAID account at Constant Contact and mailed thousands of officials a Special Alert that led to malware.
-
16 March to 14 May 2021
One Excel attachment and eight weeks: the ransomware attack on Ireland's health service
A phishing email opened in March 2021 gave Conti ransomware its way into Ireland's Health Service Executive. It detonated on 14 May and shut down the national health IT.