Zephyr Energy - £700K Lost in Cyber Attack on Payments

What Happened

Zephyr Energy, a UK-listed oil and gas company, recently fell victim to a cyber attack that resulted in a loss of approximately £700,000. The incident involved the rerouting of a contractor payment to an account controlled by the attackers. This sophisticated operation went unnoticed until the funds had already been transferred.

Who's Affected

The attack specifically targeted one of Zephyr Energy's American subsidiaries, showcasing how even established companies can be vulnerable to cybercrime. The incident has raised concerns about the security of financial transactions within the organization.

What Data Was Exposed

While the company has not disclosed specific details about how the attackers executed the rerouting, it emphasizes that the incident was contained. There is no indication that sensitive data beyond the financial transaction was compromised, but it serves as a stark reminder of the potential risks involved in payment processing.

What You Should Do

In response to the attack, Zephyr Energy has taken immediate action by notifying law enforcement and collaborating with banks and external consultants to recover the lost funds. They are also implementing enhanced security measures to prevent future incidents, which may include stricter payment verification processes and improved controls over changes to supplier bank details. Companies should consider adopting similar measures to safeguard their financial operations.

Conclusion

This incident illustrates that cybercriminals can exploit weaknesses in payment processes without needing to breach a company's network. As businesses increasingly rely on digital transactions, they must remain vigilant and proactive in securing their financial operations to avoid falling victim to similar attacks.