Alkem Laboratories: Ascend Laboratories Impersonation BEC and Enzene Biosciences Email Compromise

What happened

Alkem Laboratories, a major Indian pharmaceutical multinational, suffered two distinct, disclosed business email compromise incidents roughly 18 months apart. In the first, fraudsters impersonated an executive of Alkem's US subsidiary Ascend Laboratories LLC, exploiting knowledge of a real Rs 51.30 crore intercompany payment Ascend had just made to parent Alkem. Using a fabricated excess-tax pretext, they convinced Alkem to wire USD 6,161,336, about Rs 51.30 crore, by SWIFT to a fraudulent account at Fifth Third Bank in the US. Mumbai Police, as reported by Hindustan Times, place the fraudulent correspondence between 27 October and 17 November 2023. The scheme came apart when Alkem's finance department went to verify the transaction with the US counterparty and the real head of international operations denied having made any refund request.

Alkem's board resolved on 12 January 2024 to disclose the incident to BSE and NSE. The company booked approximately Rs 513.1 million as an exceptional item for the quarter ended 31 December 2023, describing it as a cyber security incident that compromised the business email IDs of certain employees at one of its subsidiaries. Rs 290.4 million was recovered in the quarter ended 31 March 2024, leaving an audited net exceptional loss of Rs 222.7 million. Separately, on 15 May 2025, Alkem disclosed that Enzene Biosciences Ltd's US subsidiary had suffered its own cybersecurity incident in which employees' business email accounts were compromised, again resulting in a fraudulent fund transfer; the quantum was described as under investigation and has never been published.

How it worked

Ascend Laboratories LLC, Alkem's New Jersey-based US subsidiary, made a legitimate Rs 51.30 crore payment to parent Alkem on 25 October 2023 for materials supplied between November 2022 and January 2023. Two days later, on 27 October 2023, Alkem's Mumbai-based manager of treasury operations received an email purporting to be from Ascend's head of international operations, claiming Ascend's bank had flagged that the payment would trigger exorbitant taxes running into millions of dollars, and asking Alkem to refund the sum to a new account so it could be re-sent correctly. Shortly afterwards a second email supplied the destination account details, at Fifth Third Bank in the US. Believing the correspondence genuine, Alkem wired USD 6,161,336, about Rs 51.30 crore, via SWIFT.

Who that second email came from is the point on which the sources split, and it matters. The two police-sourced reports closest to the FIR, the Free Press Journal and Lokmat Times, both say it purported to come from the company's own internal accounting manager. This file follows them, because they are the earliest accounts, the most proximate to the police complaint, and they agree with each other independently. On that reading the case is internal impersonation layered on counterparty impersonation, and the control that would have caught it has to reach inside Alkem's own finance function rather than only across to the counterparty. Hindustan Times, the more widely cited report, describes a single stream of correspondence from the impersonated Ascend executive and mentions no second sender at all. No source gives a date for the second email or for the wire itself; Hindustan Times gives only a correspondence window running from 27 October to 17 November 2023.

The scheme was built on real, non-public knowledge of an actual intercompany payment and impersonated a real, identifiable counterparty, not a generic cold lure.

The lure and the tell

The lure combined three elements: precise, non-public knowledge of a real intercompany payment made just two days earlier, lending immediate plausibility; impersonation of real, identifiable individuals rather than an anonymous sender, Ascend's head of international operations and, on the police account, Alkem's own accounting manager; and a bureaucratic, low-suspicion pretext, avoiding an exorbitant tax charge, that framed the fraudulent transfer as protecting the company's money rather than risking it.

The tell was not in the emails. It came when Alkem's finance department went to verify the transaction with the US counterparty through an independent channel, and the real head of international operations said he had made no such request. A subsequent internal investigation found the emails had come from a fake domain built to closely mimic the legitimate one, according to the Mumbai Police account. Alkem's own filing to the exchanges instead describes compromised business email IDs. Those are two different attacks with two different answers, and no source reconciles them.

Outcome

Rs 290.4 million of the wired funds was recovered in the quarter ended 31 March 2024 and disclosed in Alkem's audited results, leaving a net exceptional loss of Rs 222.7 million. That is a recovery of 56.6 percent. Lokmat Times dates the recovery to 15 March 2024 and credits assistance from US and Indian banking authorities; Hindustan Times reports that US police seized the money and it was refunded to the company. The police-sourced press figures for the same chain, Rs 51.30 crore wired, Rs 28.98 crore seized and Rs 22.31 crore net, are approximately right but do not quite close, being short by Rs 0.01 crore.

Alkem filed complaints with the Parsippany-Troy Hills Police Department and the FBI in the US, and Mumbai's Central Region Cyber Police Station registered an FIR against unidentified persons under IPC sections 419 (cheating by personation), 420 (cheating), 465, 467, 468 and 471 (forgery-related) and 34 (common intention), plus relevant IT Act provisions. No arrests are reported in the sources reviewed, and as of the February 2025 reporting, proceedings to recover the balance were still live. Alkem's filings say only that it employed independent external agencies; Lokmat Times reports those agencies as Alvarez & Marsal and PwC. Alkem stated the incident did not involve any fraudulent act by its own promoters, directors, key managerial personnel, senior management or any other employee, and disclosed the matter to BSE and NSE as a matter of governance even though it said the amount did not cross its own quantitative materiality thresholds.

Separately, on 15 May 2025 Alkem disclosed that Enzene Biosciences Ltd's US subsidiary had suffered a distinct incident in which employee business email accounts were compromised, resulting in a fraudulent fund transfer of undisclosed quantum. No figure has been published since. No Alkem result through the audited year ended 31 March 2026 records an exceptional item for it, which indicates a loss materially smaller than the Rs 513.1 million Ascend fraud rather than a comparable one.

Why it matters

This case is a well-documented, dual illustration of business email compromise risk in cross-border intercompany treasury operations at a large, publicly listed multinational: attackers weaponized real, non-public transaction context, an actual recent invoice payment, combined with impersonation of a real executive, to make a fraudulent refund request credible enough to defeat a trained treasury function.

It also shows the limits of a remediation commitment. Alkem had engaged Check Point Software Technologies in November 2023, during the fraud window itself, and in January 2024 the two issued a joint statement committing to extend the same security infrastructure across every Alkem subsidiary, domestic and international, with a particular focus on networks and email. A second email-compromise fund transfer nonetheless occurred at a different subsidiary sixteen months later. No source explains why, and no source says the Enzene subsidiary was outside that perimeter. The honest lesson is that a stated intention to extend controls group-wide is not evidence that they were extended, and a second incident at a different subsidiary is the kind of outcome that should prompt someone to ask for the coverage evidence rather than the commitment.

The case additionally illustrates that cross-border law-enforcement and banking cooperation can claw back a meaningful share of stolen funds, 56.6 percent here, when reported and acted on quickly, and it is a clean example of India's SEBI-driven listed-company cyber-incident disclosure regime in action via BSE and NSE filings.

Defenses

Controls this case argues for:

• Independently sourced callback verification, using contact details held on file rather than any supplied in the suspect email, before honoring any change-of-bank-account or refund request. Because the police account places the payment-details email inside Alkem's own finance function, that verification has to cover internal senders as well as counterparties. A callback policy written only for external vendors would not have caught this step.
• Heightened scrutiny of urgent requests to redirect funds that are tied to a real, recently completed payment. The plausibility came from the transaction being genuine.
• Monitoring for newly registered lookalike vendor and executive domains, alongside SPF, DKIM and DMARC enforcement, and separately mailbox-compromise detection. Both families of control are needed here, because the police investigation attributes the emails to a fake domain while Alkem's filing describes compromised mailboxes, and neither control covers the other's scenario.
• Dual-approval or maker-checker sign-off for cross-border SWIFT transfers above a threshold, with the second reviewer confirming any payee or account change independently.
• Extending email and endpoint security tooling uniformly across every subsidiary. This is the gap Alkem and Check Point described in January 2024, when they said the subsidiary involved in the 2023 incident had been "operating independently outside the corporate systems, which at the time was not leveraging Check Point's security solutions". That statement is about the 2023 incident; it should not be read as a description of any later one.
• Rapid law-enforcement and correspondent-bank engagement to freeze funds in the destination country before they are moved on, which is what produced the partial recovery here.