The pattern
The documented email attacks of 2021 fall into two groups. In the first, the email was only the opening move of a longer intrusion. One opened Excel attachment gave Conti ransomware eight weeks inside Ireland's Health Service Executive. A compromised USAID account at a mailing service let Russia's Nobelium group send spear-phishing that passed every sender check.
In the second group, the email was the whole crime. Fraudsters studied who a town paid, then wrote in that partner's name and asked for the money to go somewhere new. Peterborough in New Hampshire lost $2.3 million gross this way. Cottage Grove in Minnesota lost $1.28 million to an impostor writing from a domain that added three letters to its sewer contractor's.
Neither group needed technical tricks in the message. Both relied on context the reader already trusted: a colleague's attachment, a government sender, a known vendor.
The cases
-
16 March to 14 May 2021
One Excel attachment and eight weeks: the ransomware attack on Ireland's health service
A phishing email opened in March 2021 gave Conti ransomware its way into Ireland's Health Service Executive. It detonated on 14 May and shut down the national health IT.
-
January to May 2021, peaking on 25 May
Nobelium sends spear-phishing from a real USAID mailing account
In May 2021 the Russia-based Nobelium group took over a USAID account at Constant Contact and mailed thousands of officials a Special Alert that led to malware.
-
9 July to 13 August 2021
Peterborough, New Hampshire loses $2.3 million to emails that copied its partners
In the summer of 2021 a town of about 7,000 people paid its school district and a bridge contractor into fraudsters' accounts after emails that imitated both.
-
18 October to 22 December 2021
Cottage Grove, Minnesota: three extra letters in a domain cost $1.28 million
In late 2021 an impostor wrote to the city as its sewer contractor's president, from a domain with "inc" added, and said the company had moved its banking.
One more case shows how hard the channel can be to prove. Between March and May 2021 attackers took over at least 6,000 Coinbase customer accounts. Coinbase said it believed phishing was the source of the stolen credentials, and described a Coinbase-branded phishing campaign that got past some spam filters, but it could not establish how they were obtained. The attackers also abused a flaw in its SMS account recovery. Because the email link is a belief and not a finding, the case is not counted in this archive.
The figures
The FBI's Internet Crime Complaint Center (IC3) publishes the complaints Americans file each year. Its 2021 report ranked phishing first by number of victims and business email compromise first by money lost.
| Measure | 2021 |
|---|---|
| All complaints | 847,376 |
| Reported losses, all crimes | over $6.9 billion |
| Phishing, vishing, smishing and pharming victims (rank 1) | 323,972 |
| Business email compromise complaints | 19,954 |
| Business email compromise adjusted losses (rank 1) | $2,395,953,296 |
The report noted that stolen wire transfers were often moved straight into cryptocurrency wallets, which made recovery harder. It also described fraudsters in business email compromise using deepfaked audio in virtual meetings, posing as executives. When victims reported quickly, IC3's Recovery Asset Team placed a hold on about $329 million, a 74% success rate on the cases it worked.
Outside the United States the picture was similar. The UK government's Cyber Security Breaches Survey 2021 found that 39% of businesses had identified a breach or attack in the previous year, and phishing was involved for 83% of them. Verizon's Data Breach Investigations Report for 2021 found phishing in 36% of the breaches it analysed and put the median loss in a business email compromise at $30,000.
Sources
- Internet Crime Report 2021, FBI Internet Crime Complaint Center, 22 March 2022.
- FBI press release on the 2021 report, FBI, 22 March 2022.
- The Record's report on the 2021 figures, Jonathan Greig, The Record, 24 March 2022.
- Cyber Security Breaches Survey 2021, UK government, 24 March 2021.
- 2021 Data Breach Investigations Report, Verizon, May 2021.
- Hackers rob thousands of Coinbase customers using MFA flaw, Lawrence Abrams, BleepingComputer, 1 October 2021.
- Hackers bypass Coinbase 2FA to steal customer funds, Catalin Cimpanu, The Record, 1 October 2021.