Customer Loses $1.7 Million in Phishing Scam, Sues MSP

An Ohio company that fell prey to a $1.7 million phishing scam is suing its managed services provider.

Boardman Molded Products this week filed a lawsuit against Involta, which it says “failed to protect Boardman’s bottom line” with respect to a breach that took place two years ago. Threat actors gained access to an internal email account and sent six invoices to Boardman’s accounting team over the course of nine days.

The losses totaled $1,759,415, according to a police report .

Now Boardman is suing Involta for breach of service order, and professional negligence and malpractice. It claimed in its lawsuit filing that the MSP didn’t provide the necessary service or training required to stop the crime.

“Boardman relied upon the representations of Involta and accepted Involta’s offer to let Boardman’s IT staff focus on innovation and business-oriented tasks, while Involta was to protect Boardman’s bottom line with secure, highly-available services hosted in Involta’s enterprise-class facilities,” Boardman’s filing said.

Boardman is seeking more than $25,000, plus legal fees.

Involta claimed that the customer’s security policies “were too relaxed,” according to the lawsuit.

Boardman employees didn’t notice a problem with the invoices, as they came from the business owner’s email address and used his normal invoice template. The attackers were using the owner’s Outlook account; he’s owned the business since 1978. The accounting team authorized their bank to wire money to companies in Hong Kong and Cambodia, according to The Business Journal.

The plastic fabrication company and Involta in April 2017 signed a three-year contract totaling $10,995 in monthly recurring charges. Boardman informed Involta that it is terminating the contract.

The company reported the fraudulent invoices to the police on Jan. 25, 2018, and the FBI joined the search for the perpetrators. Boardman’s lawsuit claims that Involta listed the incident as medium priority when Boardman issued a service ticket.

“The day after the incident was first reported, Involta insisted that the breach had never taken place and accordingly closed the ticket,” the filing said.

Involta is an Iowa-based IT service provider that in 2015 acquired DRS, an Ohio-based MSP and consulting firm. A 2018 acquisition of another Ohio-based MSP brought its employee count up to 250. It operates more than a dozen data centers across the Midwest and Arizona.

Neither Boardman nor Involta responded to requests for comment.

You can read a copy of the lawsuit filing, which contains the original service contract and a rundown of Boardman’s complaints.

Recent studies have shown that phishing attacks are a top fear for businesses, and cybercriminals seem to view phishing as a rising opportunity. Attackers last summer used this method to strike a prominent channel-focused vendor and attempt to infiltrate other members of the agent community. An AT&T Cybersecurity study found that 29% of businesses view phishing as their most concerning threat.

“One of the reasons they’re so profitable is, unfortunately, us. Human nature,” ProServeIT Corp‘s Marc Mendez wrote in a blog. “Threaten to freeze our accounts and we stop thinking rationally. Offer a bit of flattery and we’re likely to not perceive a threat. Threaten jail time, we panic. These are quite legitimate human vulnerabilities that threat actors prey upon to get us to abandon better judgment and click what they want us to click.”

ID Agent recently recommended two questions employees should ask to help spot nefarious email activity.