Case Study: A UK Warehouse Phishing Attack That Cost £62,000 in a Single Wire Transfer

• Repeat fraud through the same compromised mailbox if the attacker retained access.
• Onward attacks against the warehouse's own customers using the credibility of the compromised account, with reputational damage and possible loss of contracts.
• ICO enforcement under UK GDPR following confirmed third party access to identifiable customer order data.
• Cyber insurance dispute, as the policy required MFA on all administrative accounts and tested email security controls.
• Loss of the largest customer, who had a contractual right to terminate on confirmed data breach with no remediation plan.

• Initial compromise was an Adversary in the Middle phishing kit hosted on a recently registered domain. The kit harvested both the password and the live session cookie, allowing the attacker to bypass MFA had it been enabled.
• Once inside, the attacker created three hidden Outlook rules that auto deleted any message mentioning ‘bank’, ‘fraud’ or the spoofed supplier's real domain.
• The attacker had read approximately 480 emails across the finance and operations mailboxes, including signed supplier agreements and a customer pricing schedule.
• There was no evidence of malware on endpoints. This was purely an identity and email compromise, the most common pattern we now see across UK SMEs in the sector.
• The look alike domain used in the fraud had been registered eleven days before the loss, consistent with the attacker's planning timeline once inside the mailbox.

1. 01

   Enforce phishing resistant MFA

   Rolled out Microsoft Authenticator number matching for every user, blocked SMS based MFA, removed legacy authentication protocols and enforced conditional access policies that require compliant devices for finance roles.

2. 02

   Deploy a real email security gateway

   Layered a managed email security gateway in front of Microsoft 365 to catch look alike domains, brand impersonation and AITM phishing kits, and added a single click ‘Report Phishing’ button across all mailboxes.

3. 03

   Add managed EDR and audit logging

   Deployed managed endpoint detection and response across every laptop, enabled unified audit logging and shipped logs to a 90 day retention store so future investigations are quick and complete.

4. 04

   Rewrite the supplier payment process

   Required dual approval on any change to supplier bank details, mandatory phone callback to a previously known number, and a two person rule on any payment over £2,000.

5. 05

   Run a tailored phishing simulation programme

   Launched a quarterly phishing simulation programme with realistic warehouse and finance themed lures, plus short, role specific micro training for finance, customer service and warehouse supervisors.

The client absorbed a net loss of around £44,000, retained their largest customer after a frank disclosure conversation and a documented remediation plan, settled their cyber insurance claim, and used the incident as the trigger for a long overdue rebuild of their identity and email posture. Twelve months on, the warehouse has won two new contracts, both of which required evidence of MFA, email security and incident response capability that the business could now provide.

If you operate a UK warehouse, 3PL or distribution business, we can harden your Microsoft 365, email and finance process to make this attack pattern fail. We deliver phishing resistant MFA, managed email security, managed EDR, supplier payment process design and a quarterly simulation programme tailored to warehouse and logistics teams. If you suspect a live compromise, we can be in the tenant investigating within hours.