Analytics firm in Pune loses Rs 2.34 crore in ‘whale phishing’ attack

Since the accounts manager was at a hospital for a family emergency at the time when the call was made to him, he asked the complainant to get in touch with the number. As instructed by the unidentified number, the complainant shared details of deposits in multiple bank accounts of the company, which collectively totalled to Rs 8 crores.

Over the next five days, the company’s accounts staffers were manipulated to make as many as 13 transfers, totalling Rs 2.34 crores to fraudulent mule accounts. The caller gave various business transactions as the reasons behind these transfers.

The mule accounts used were from bank and small finance entities registered in places such as Mau in Uttar Pradesh, Bhojpur in Bihar, Sonitpur in Assam, Shyam Bazaar in Kolkata, Ernakulam in Kerala and Darjeeling in West Bengal.

Once the transfers had taken place, another senior director of the company made inquiries and found out that the CEO had not given any such instruction to make these transfers and it came to light that the company had been targeted in a whale phishing attack. The complainant later approached the cyber crime police station and an FIR was registered on Saturday.

In a case registered earlier this month, a city-based consultancy firm, which is part of a Pune- headquartered multinational group of companies, lost Rs 1.9 crore in a whale phishing attack after the cyber criminals posing as the company director messaged the firm’s accounts manager, asking him to make large transfers to fraudulent accounts claiming it was for a new project the company had received.

Whale phishing attacks, also known as ‘spear phishing attacks’ or ‘CEO scams’, are highly focused on specific individuals in companies. These scams specifically target top officials of the companies who handle finances. The term “whale phishing” emphasises the targeting of key figures in the companies.

Since 2202, the Pune city and Pimpri Chinchwad police have together registered close to a dozen cases of ‘whale phishing attacks’. In one such case, Pune headquartered global vaccine major Serum Institute of India was swindled of Rs 1 crore in 2022. In another case in January last year, a real estate company in Pune lost Rs 4 crores for which a 21-year-old woman from Faridabad in Haryana was arrested for her alleged role in the whale phishing attack.

The woman, identified as Saniya Mustakim Siddique, was identified as a key suspect based on the technical analysis of the phone numbers and bank accounts used in the whale phishing attack. When she was being brought to Pune on Duronto Express, she escaped from the train at Kota statioin in Rajasthan on February 18 last year. After a months-long search, she was finally arrested in December last year.