ARUP, a British engineering company, has confirmed that it fell victim to fraud involving the transfer of 200 million Hong Kong dollars (20 million pounds) to criminals using a deepfake video.
Earlier this year, the Hong Kong police reported that an employee of an unnamed company was deceived into transferring a large sum of money to attackers who impersonated company leaders.
In a statement, ARUP acknowledged that it was the company targeted by the fraud and had alerted the Hong Kong authorities at the beginning of the year. The company revealed that fake videos and images were used in the scam.
ARUP emphasized that the financial stability and business operations of the company remained intact, and its internal systems were not compromised.
Rob Graig, ARUP’s chief information director, highlighted that the company regularly faces various cyber attacks, including phishing attempts and deepfakes. Graig commented on the increasing number and complexity of these attacks in recent months.
He expressed hope that ARUP’s experience would raise awareness about the evolving nature of cyber threats. The incident involving ARUP was first reported by the Financial Times.
ARUP, known for its engineering projects like the Sydney Opera House and Crossrail in London, employs over 18,000 individuals worldwide.
In a separate incident last week, the CEO of WPP, the world’s largest advertising group, also fell victim to fraud through a deepfake video. In a letter to staff, Mark Read cautioned employees to be vigilant against fraudulent calls impersonating company management.
Reports from Hong Kong media stated that the employee at ARUP was lured into a video conference with multiple participants who appeared to be genuine. The employee made 15 transfers totaling 200 million Hong Kong dollars to five local bank accounts.
Currently, there have been no arrests made in connection to the fraud case, which is under investigation and classified as “obtaining property by deception.”