They survived one cyberattack. Their IT team said it was handled. Then hackers came back and stole $100,000 without anyone realizing what was happening.
A South Carolina company specializing in buying and selling specialty commercial trucks and trailers learned an expensive lesson about cybersecurity.
The company had already experienced a phishing attack involving its Chief Financial Officer (CFO). The attack affected business operations and resulted in some financial losses, but leadership considered the damage relatively minor.
Their IT team supposedly cleaned everything up.
Business returned to normal.
And they made no significant changes to their cybersecurity approach.
That decision would come back to haunt them.
Because the next attack wasn’t just another suspicious email.
This time, the criminals were inside their email system, watching and waiting for an opportunity to steal.
The First Attack Was a Warning. They Didn’t Listen.
The first cybersecurity incident began with a phishing attack involving the company’s CFO.
Phishing attacks can trick employees into revealing passwords, opening malicious attachments, or giving criminals access to sensitive business information.
In this case, the incident caused some financial damage and disrupted the business.
But the company believed it had escaped relatively unharmed.
Its existing IT team addressed the immediate problem and assured the business that everything had been cleaned up.
There was no major overhaul of its cybersecurity strategy.
No outside cybersecurity specialists were brought in to independently evaluate the company’s protections.
And the organization continued operating much as it had before.
The business treated the first attack as a problem that had been solved rather than a warning that its defenses needed closer examination.
Unfortunately, it wouldn’t be the last time hackers targeted the company.
The Second Attack: Someone Was Watching Their Emails
The second attack was much more sophisticated.
This time, criminals managed to gain unauthorized access to the company’s email environment.
And nobody knew they were there.
They could observe business communications and look for opportunities to exploit legitimate transactions.
This type of attack is known as email hijacking or Business Email Compromise (BEC).
Unlike the obvious phishing emails many people recognize, BEC attacks can involve criminals accessing real business email accounts and monitoring legitimate conversations.
The emails look normal because the conversations are real.
The people involved are real.
And the transactions are real.
Until the attacker decides to interfere.
For this South Carolina company, that opportunity came when a $100,000 wire transfer appeared in an email conversation.
One Changed Routing Number. $100,000 Gone.
The criminals saw the financial transaction being discussed.
They intercepted the email communication and altered the payment instructions, replacing the legitimate routing information with information that would direct the money to an account they controlled.
The payment was sent.
But the money never reached its intended destination.
Instead, $100,000 went to the hackers.
Think about that for a moment.
The company was conducting what appeared to be an ordinary business transaction.
There wasn’t necessarily a suspicious attachment to open or an obviously fraudulent message to identify.
The attackers had access to legitimate communications and used that access to manipulate a real payment.
By the time the company realized the intended recipient had never received the money, the damage was done.
And suddenly, the business had to confront a frightening possibility:
If hackers could secretly monitor and manipulate a $100,000 transaction, what else could they access?
Customer information? Vendor relationships? Employee communications? Other financial transactions?
The company could no longer assume its private business communications were actually private.
The Problem Wasn’t Just the Hack. It Was the Security They Trusted.
One of the most dangerous cybersecurity assumptions a business can make is believing it is protected simply because someone says it is.
Having an IT provider doesn’t automatically mean a company has adequate cybersecurity.
Having security software doesn’t mean that software is configured correctly.
And having someone monitor your network doesn’t necessarily mean they have the experience or resources to recognize every significant threat.
Cybersecurity tools are only as effective as the strategy, implementation, oversight, and expertise behind them.
That is especially important after a security incident.
Addressing the immediate attack is only the beginning.
A qualified response should also determine how the compromise occurred, evaluate whether unauthorized access remains, identify weaknesses that contributed to the incident, and implement appropriate protections to reduce the risk of another attack.
Otherwise, a business could return to normal operations while the underlying vulnerabilities remain.
That is the real horror in this story.
The first attack cost the business money.
The second cost it $100,000.
And the company had believed its cybersecurity was being handled all along.
Then They Called IntelliSystems.
Once the company discovered the fraudulent wire transfer, its leadership contacted IntelliSystems.
Our team stepped in to investigate and address the compromised email environment.
We worked to remove the unauthorized access, secure the affected systems, and implement stronger cybersecurity protections designed to prevent similar incidents.
But this wasn’t simply about cleaning up another attack.
It was about addressing the security weaknesses that had allowed the company’s email environment to become vulnerable.
At IntelliSystems, cybersecurity isn’t the responsibility of one or two technicians operating independently.
We have teams of experienced IT and cybersecurity professionals with specialized knowledge, professional certifications, and the ability to collaborate across different areas of technology.
That matters because business technology is interconnected.
An email security issue can become a financial loss.
A poorly configured security tool can leave a critical gap.
A missed warning can become a major business disruption.
Our teams work together to implement protections, review configurations, monitor systems, and provide additional oversight.
The goal is not simply to install security tools.
It’s to make sure the right protections are in place, configured appropriately, and continually managed.
Six Years Later, No Repeat Incident
The attack happened approximately six years ago.
Since IntelliSystems addressed the compromise and implemented stronger protections, the company has not reported another cybersecurity incident.
That doesn’t mean any business can eliminate every possible cyber risk.
No cybersecurity provider can honestly promise that.
But it demonstrates the value of taking cybersecurity seriously, investing in qualified professionals, and addressing underlying weaknesses instead of treating each attack as an isolated problem.
The company didn’t just need someone to make the immediate problem disappear.
It needed experienced people who understood how to strengthen its defenses and help protect its business over the long term.
And that’s exactly what IntelliSystems was brought in to do.
Business Email Compromise Is Costing Companies Billions
This South Carolina company’s experience is far from unique.
According to the FBI’s 2025 Internet Crime Report, Business Email Compromise was responsible for more than $3 billion in reported losses in a single year.
These attacks frequently target companies that conduct wire transfers, communicate with vendors by email, and depend on electronic payment instructions.
The FBI recommends independently verifying changes in payment instructions, using multifactor authentication, and carefully reviewing requests involving financial transactions.
But preventing Business Email Compromise also requires technical protections behind the scenes.
Businesses should evaluate:
- Email account security: Are unauthorized sign-ins detected and investigated?
- Multifactor authentication: Are accounts protected with appropriate additional verification?
- Email monitoring: Are suspicious access attempts, unusual activity, and potentially malicious forwarding rules being identified?
- Security configurations: Are protection tools set up correctly and regularly reviewed?
- Payment verification procedures: Does the business independently verify banking changes through trusted contact information?
- Incident response: If an account is compromised, does the IT team know how to investigate, contain, and remediate the attack?
These protections work together.
And each depends on people who understand how to implement, monitor, and maintain them.
Would You Know If Someone Was Reading Your Company’s Emails?
Imagine a criminal quietly watching your company’s financial conversations.
They know who you work with.
They know what you’re buying or selling.
They know when payments are coming.
And they’re waiting for an opportunity to redirect your money.
Would your current cybersecurity protections detect them?
Would your IT team know where to look?
And if your business experienced a cyberattack last year, how confident are you that every weakness was actually addressed?
Those are questions worth answering before $100,000 disappears.
Don’t Wait for a Second Attack to Find Out Your Security Isn’t Enough.
At IntelliSystems, we help businesses throughout Georgia and South Carolina protect their systems, strengthen their cybersecurity, and reduce the likelihood of costly disruptions.
Our Managed IT and Cybersecurity services combine experienced professionals, proactive monitoring, and ongoing support.
And if you already have an internal IT team or another provider, you don’t have to switch to find out where your security stands.
Our Cyber Defense Assurance Audit (CDAA) provides an independent evaluation of your cybersecurity environment, helping identify weaknesses, misconfigurations, and areas that may need attention.
Because having cybersecurity and having cybersecurity that actually works are two very different things.
Don’t let a small warning become a $100,000 lesson.
Schedule your Cyber Defense Assurance Audit with IntelliSystems today.
Frequently Asked Questions About Business Email Compromise
Frequently Asked Questions About Business Email Compromise
What is Business Email Compromise (BEC)?
Business Email Compromise is a type of cybercrime in which attackers impersonate trusted business contacts or gain unauthorized access to legitimate email accounts to steal money or sensitive information. A common example involves changing payment instructions so a legitimate wire transfer is sent to a criminal’s bank account.
Can hackers access business email without employees knowing?
Yes. Criminals who compromise an email account may be able to read messages, monitor conversations, create forwarding rules, and manipulate communications without immediately alerting the account owner. Proper security configurations, multifactor authentication, and monitoring can help detect and prevent unauthorized activity.
How can a business prevent wire transfer fraud?
Businesses should independently verify changes to payment instructions using a trusted phone number, require additional approval for significant financial transactions, and use strong email security protections. Employees should never rely on email alone to confirm a change in banking information.
Is having antivirus software enough to prevent email hijacking?
No. Antivirus software alone cannot adequately address every email-related security threat. Businesses also need appropriate account protections, multifactor authentication, email security configurations, monitoring, employee training, and procedures for verifying financial transactions.
What should a company do if its business email is compromised?
Immediately contact qualified cybersecurity professionals to investigate and contain the compromise. If a fraudulent wire transfer occurred, contact the bank immediately to request a recall and report the incident to the FBI’s Internet Crime Complaint Center at IC3.gov. The business should also investigate unauthorized account access, secure affected credentials and sessions, examine suspicious email rules, and evaluate any potential exposure of sensitive information.
Can IntelliSystems help if we already have an IT provider?
Yes. IntelliSystems offers a Cyber Defense Assurance Audit that allows businesses to independently evaluate their cybersecurity posture without changing IT providers. We also provide co-managed IT services for organizations that want to retain their internal IT team while adding specialized cybersecurity expertise and support.
For more real life Cybersecurity Horror Stories, click here.
