$6.4 million, one spoofed email, and a union the DOJ never named

Background

Not every incident worth studying involves a hypervisor rootkit or a nation-state. A labor union based in Dorchester, Massachusetts — never publicly named by the Department of Justice — lost $6.4 million to a business email compromise in January 2023: an email that looked like it came from the union's own investment manager, asking for a payment to what turned out to be a fraudulent account. That's the entire technical story. What happened afterward is the more interesting part.

How little it took, and how much came back

What actually happened

In January 2023, someone at the union received an email that appeared to come from the organization's investment manager. It asked for a payment — ordinary enough on its face — to an account that wasn't actually the investment manager's. No malware was involved, no network was breached, no credentials were stolen. The email itself was the entire attack. The union wired $6.4 million.

The money didn't stay in one place. Investigators later traced it through intermediary accounts, including attempts to move funds through a cryptocurrency exchange and into accounts tied to Hong Kong, mainland China, Singapore and Nigeria, alongside seven domestic US accounts used along the way. Tracing money through that many jurisdictions and account types is slow, deliberate work, not a single wire reversal.

The US Attorney's Office for the District of Massachusetts, working with the Secret Service, filed a civil forfeiture action in June 2024 — a legal action against the traceable funds themselves, not a criminal case against a specific person. A default judgment and final order of forfeiture, reported in early 2025, secured roughly $5.3 million of the $6.4 million stolen.

Root cause

Timeline

Detection

What to monitor for in your own environment

Containment, eradication & recovery

Security control analysis

Controls that would have prevented or limited this

Blast radius

Most of the money came back — without an arrest

What they got right

Investigators treated the stolen funds as traceable property worth pursuing internationally, rather than writing off a wire sent across multiple jurisdictions as unrecoverable.

The US Attorney's Office used civil forfeiture specifically because it doesn't require first identifying and charging a suspect — a deliberate legal strategy to get money back when a criminal case may never be possible.

Federal agencies coordinated across a case touching accounts in at least five jurisdictions, exactly the kind of multi-hop laundering path most victim organizations have no ability to trace on their own.

Why this keeps happening

Business email compromise doesn't need malware, a vulnerability, or any technical sophistication at all — it needs one convincing email and one person with the authority to approve a payment. That's a far lower bar than any other incident in this series, which is exactly why BEC remains one of the most common and most expensive categories of cybercrime reported every year.

Organizations that manage large pooled funds — unions, pension funds, nonprofits, HOAs — often have less security infrastructure than a company moving comparable sums of money, while being exactly as attractive a target to someone willing to send a convincing email.

Recovery through forfeiture depends on the money being traceable before it's fully laundered out. Every hour between the fraudulent wire and the fraud being discovered shrinks the odds of getting any of it back — this case recovered most of its losses, but a slower discovery often means recovering little or nothing.

Lessons for your own environment

1. A callback to a known number beats trusting the email

   A single phone call to the investment manager, using a number already on file rather than one in the email, would have caught this before the wire went out. That one habit is the entire defense against this category of fraud.

2. Any change to payment instructions needs a second channel of verification

   The fraud worked specifically because the beneficiary account changed and nobody independently confirmed the new details before sending $6.4 million to them.

3. Small organizations with large pooled funds are specifically attractive targets

   A union, pension fund or nonprofit often moves sums that rival a mid-size company's, without a comparable security team watching for this exact pattern.

4. Recovery doesn't require catching anyone

   Civil forfeiture recovered most of the money here with no named suspect. Report a BEC loss immediately regardless of whether you expect anyone to ever be identified.

5. Speed of discovery determines how much comes back

   Tracing funds through multiple countries and account types before they're fully laundered out is a race against time. The sooner a fraudulent wire is reported, the better the odds of tracing it at all.

6. An unnamed victim is still a real one

   This union was never publicly identified, and that's worth remembering before assuming "it couldn't happen to an organization like ours." Plenty of organizations this size are quietly handling exactly this, without it ever becoming a headline.

CISO & board lessons

• If your organization moves large pooled funds but doesn't think of itself as a typical security-budget-sized target — a union, a pension fund, a nonprofit, an HOA — this case is the one to show leadership. The attacker needed no technical sophistication at all, only an email convincing enough and a payment process with no second channel of verification.
• A board overseeing a small organization with large financial flows should ask, specifically, what single control stands between a convincing email and a seven-figure wire transfer. In this case, the honest answer was none.
• Recovery and accountability are two different outcomes, and a board needs to understand that a financial recovery like this one — real, and worth roughly 83 cents on every dollar — does not mean the organization now knows who attacked it or whether it could happen again from the same source.
• Build the relationship with law enforcement (FBI IC3, your local US Attorney's Office) and your bank's fraud department before an incident, not during one. The forfeiture recovery here depended on fast, informed reporting — a relationship an organization scrambling to find the right contact during a crisis doesn't have.

Action plan

Could this happen in your organization?

• If your investment manager, vendor, or any routine payee emailed tomorrow asking to change their bank account details, what would actually stop someone from just sending the payment?
• Does your organization require a callback to a number already on file — not one provided in the request — before acting on any changed payment instruction?
• Who has sole authority to approve a six- or seven-figure wire transfer at your organization, and is a second person's independent sign-off actually required?
• If a fraudulent wire went out today, would your finance team recognize it and report it within hours, or would it likely take days to even notice?
• Does anyone at your organization already know how to file an FBI IC3 complaint or request an emergency wire recall from your bank, without having to look it up during a crisis?
• If your organization manages a large pooled fund (union dues, pension assets, member contributions), does your security budget and process discipline actually match the size of the funds you move — or just the size of your staff?

If this happened to you: what to ask, and what to say

Knowing the lesson isn’t the same as knowing what to do with it Monday morning. A security lead, a CISO, and a customer-facing team each need something different from this incident.