Responding to a $500K Business Email Compromise in a National Engineering Organisation

The Challenge

A national civil engineering organisation operating across New South Wales, Victoria, and Queensland experienced a serious business email compromise involving a government invoice payment. By the time Pyneora was engaged, the fraudulent transaction had already occurred and the matter was under investigation by a cybercrime unit.

The attacker gained access to a Google Workspace email account and used that mailbox to manipulate legitimate invoice correspondence. Bank account details were altered and resent through the compromised email account, making the request appear authentic to the receiving organisation. This resulted in approximately $500,000 being transferred to a fraudulent third-party account.

Once the funds reached the receiving account, they were rapidly moved offshore and could no longer be recovered through normal response channels. The immediate priority was therefore not to reverse the completed fraud, but to identify how the compromise occurred, contain any remaining unauthorised access, and reduce the likelihood of further incidents.

The review also identified broader control gaps across identity, endpoint security, network visibility, and document access. Email accounts were not protected by enforced multi-factor authentication, endpoint monitoring was limited, and the organisation relied on a local NAS-based file sharing model where staff had broad access to documents across the business rather than least-privilege access aligned to roles and departments.

The Approach

Immediate Containment

• Performed an urgent post-incident review to determine the likely compromise path and identify immediate containment actions.
• Confirmed the incident originated from a compromised Google Workspace account, most likely accessed using a known, reused, or shared password.
• Immediately enforced multi-factor authentication across Google Workspace to reduce the risk of further account takeover.
• Reviewed mailbox access, account security settings, authentication controls, and suspicious access patterns for signs of continued unauthorised activity.
• Implemented geographic access restrictions to reduce exposure from unexpected international login locations.
• Acted as an interim approval point for key access requests during a 90-day heightened monitoring period.

Identity & Access Hardening

• Recommended Microsoft Entra ID conditional access controls, multi-factor authentication, recognised device policies, and geographic access restrictions.
• Reviewed the organisation's local NAS-based file sharing model and identified excessive access permissions that did not follow least-privilege principles.

Endpoint & Network Security

• Recommended additional endpoint security controls for the organisation's macOS fleet, including device compliance, patch management, and security monitoring.
• Assessed options for managing the macOS endpoint environment using Jamf and Microsoft Intune to support patching, compliance, and ongoing security policy enforcement.
• Recommended IDS/IPS capability at the primary headquarters network to improve visibility of suspicious activity across endpoints and internal systems.
• Introduced Cisco Meraki security capability at the network edge to provide firewall protection with IDS/IPS functionality.

Secure Document Management Redesign

• Proposed migration from Google Workspace and unsecured NAS file sharing to a Microsoft 365 and SharePoint document management model.
• Designed a national SharePoint document management structure with granular departmental access, controlled client sharing, and stronger identity-based access controls.

Process Controls

• Recommended business process controls for payment fraud prevention, including independent verification of bank account changes before invoice payments are processed.

Lessons for Australian Businesses

This incident reflects a pattern increasingly seen across Australian mid-market organisations: cloud email platforms without enforced multi-factor authentication remain one of the most common entry points for business email compromise and invoice fraud. Once inside a mailbox, attackers don't need to breach financial systems directly - they exploit the trust embedded in existing business correspondence.

For organisations relying on Google Workspace or Microsoft 365 without conditional access policies, geographic restrictions, and independent payment verification processes, the risk profile is materially higher. The remediation pathway in this case - identity hardening through Entra ID, structured SharePoint access governance, and endpoint visibility - reflects the layered approach Pyneora applies across Microsoft 365 security engagements for Australian businesses.