The pattern
This summary covers January to early November 2026. The year's documented email attacks are dominated by payment fraud against public bodies in the United States. Dickinson Public Schools in North Dakota paid nearly $5 million meant for a builder. Pine Bluff School District in Arkansas wired $3.2 million after fake instructions were slipped into a genuine invoice thread. Pulaski County, also in Arkansas, paid its jail medical contractor's bills to a stranger for months. In each case the fraud surfaced because a bank, a vendor or an official noticed money in the wrong place, not because anyone spotted the email.
The pattern repeats on a smaller scale. In October the City of Liberty, Texas, said it had wired about $600,000 after an email from a lookalike domain that imitated a vendor it really owed that amount. Its receiving bank flagged the transfer after it was sent.
Credential phishing kept its familiar shape. At IEH Corporation, a US maker of military devices, a link disguised as a Microsoft document share led an employee to a fake login page and opened a mailbox with engineering files in it.
Attacks on AI assistants continued as researcher findings that vendors then fixed. In January Radware described ZombieAgent, which used hidden instructions in an email to a Gmail inbox connected to ChatGPT, and got around OpenAI's earlier fix for ShadowLeak. In March Microsoft fixed a flaw that let hidden text in an email make Copilot's summary in Outlook show a fake security alert.
The cases
-
November 2025 to February 2026
Dickinson Public Schools pays nearly $5 million to a fake builder
Between November 2025 and February 2026 a North Dakota school district sent two construction payments to a fraudster's account. The FBI recovered the money.
-
Reported 23 January 2026, fixed by 11 March 2026
Copilot in Outlook shows a fake security alert written by an attacker
In 2026 a researcher showed that hidden text in an email could make Copilot's summary in Outlook show a fake security alert. Microsoft fixed it in March.
-
17 December 2025, disclosed 27 April 2026
Pine Bluff schools wire $3.2 million after fake instructions join a real invoice thread
In December 2025 an Arkansas school district paid a construction invoice to the wrong account. The wiring instructions had been slipped into a genuine email thread.
-
Discovered 4 August 2026, disclosed 6 August
IEH Corporation: a fake sharing link opens a defence supplier's mailbox
In August 2026 an employee of a US military supplier entered Microsoft 365 credentials on a fake page. The mailbox held engineering files.
-
19 June to 23 October 2026
Pulaski County pays a jail contractor's bills to a stranger for months
One email in June 2026 changed where an Arkansas county paid its jail medical contractor. About $1.9 million went astray until the real firm asked why.
The figures
The FBI's report on 2026 will not appear until 2027. Its report on 2025, published in April 2026, is summarised in the 2025 summary. Three other series published their latest editions during 2026.
| Source and period | Finding |
|---|---|
| UK Cyber Security Breaches Survey 2025/2026, fieldwork August to December 2025 | 43% of businesses reported a breach or attack. Phishing was involved for 88% of them. |
| ENISA Threat Landscape 2026, covering 2025 | Phishing was 77.8% of the social engineering techniques seen, followed by malicious spam at 13%. |
| Verizon Data Breach Investigations Report 2026, executive summary | The human element was present in 62% of breaches. Phishing stayed at 16% of breaches. |
ENISA's 2026 share is measured within social engineering techniques, while its 2025 figure was a share of all intrusions, so the two are not a trend. The UK survey's phishing share among affected businesses has stayed between 79% and 88% in every edition since 2021.
Sources
- Cyber Security Breaches Survey 2025/2026, UK government, 30 April 2026.
- ENISA Threat Landscape 2026, European Union Agency for Cybersecurity, September 2026.
- 2026 Data Breach Investigations Report, executive summary, Verizon, 2026.
- KPRC report on the City of Liberty's loss, KPRC Click2Houston, 14 October 2026.
- Bluebonnet News report with the city's statement, Bluebonnet News, 14 October 2026.
- OpenAI putting bandaids on bandaids as prompt injection problems keep festering, Thomas Claburn, The Register, 8 January 2026.
- ZombieAgent Attack Let Researchers Take Over ChatGPT, SecurityWeek, 9 January 2026.