Leoni AG CEO Fraud (2016)

What happened

On Friday, 12 August 2016, Leoni AG, a German manufacturer of cables and wiring systems for the automotive and other industries, then listed on the MDAX, discovered it had been defrauded of approximately EUR 40 million. Attackers had impersonated senior Leoni executives using spoofed email identities and falsified documents and communications, directing the finance/accounting department of Leoni's Romanian subsidiary operation in Bistrița, the only one of Leoni's four Romanian plants authorized to make money transfers, to wire the funds to accounts the attackers controlled. That date is when the fraud was found, not when it began. Leoni's then chief financial officer, Karl Gadesmann, told the company's annual results conference on 23 March 2017 that the fraudsters had ordered numerous transfers, mostly of single-digit millions each, and that the whole thing ran over a period of three weeks, fast enough that no reaction time was left to stop transfers already moving through a widely branched network. Leoni publicly disclosed the fraud in a German ad hoc (inside-information) announcement on 16 August 2016, stating its IT infrastructure and data security had not been compromised, that it had filed a police report, and that it was assessing insurance claims and the impact on results. A follow-up ad hoc disclosure on 14 September 2016 confirmed the roughly EUR 40 million loss would be fully absorbed in Q3/FY2016 earnings, cutting Leoni's FY2016 EBIT guidance from EUR 105 million to EUR 65 million.

How it worked

Attackers impersonated senior Leoni AG executives (headquartered in Nuremberg, Germany) via spoofed or cloned email accounts/identities and falsified documents, sending instructions that appeared to originate from company leadership to the finance/accounting department of Leoni's Romanian subsidiary operation in Bistrița, the only one of Leoni's four Romanian plants authorized to make money transfers, which is reportedly why attackers targeted it specifically. Romanian press reporting named the head of that finance department, who was dismissed following the fraud along with two other finance staff. Her name is not reproduced here: she is a private individual, she publicly maintained that she followed company protocol, Leoni stated it had no indication that any employee was complicit in the scheme, and Romanian local outlets themselves stopped naming her in later coverage. The local finance staff, believing the instructions were genuine, urgent, and confidential executive directives, authorized and executed transfers totaling approximately EUR 40 million (see Financial impact for the prosecutor's more precise complaint figure) to accounts controlled by the attackers. This was not one payment but a run of them, mostly single-digit millions each, spread over about three weeks, and nobody flagged the sequence as suspicious while it was running. Where the money went was settled on the record by Leoni's own chief financial officer in March 2017: the funds were moved through a widely branched network of more than 50 accounts worldwide, which is what made the trail so hard to follow, and they ended up in accounts in China and Hong Kong. Romanian reporting that the first receiving account belonged to a Czech-registered labor-recruitment company is compatible with that as a first hop, but it rests on unofficial sourcing in every outlet that carried it: Gazeta de Cluj attributes it to unofficial sources and Softpedia calls it unconfirmed information. Leoni stated publicly that its IT systems and data security were not breached, framing this as pure social engineering of people and process rather than a network intrusion, so that the fraud succeeded entirely through impersonation and exploitation of the subsidiary's payment-authorization workflow rather than any technical compromise. A minority, anonymously-sourced account (Evenimentul Zilei, citing DIICOT-Cluj judicial sources) directly disputes this: it claims attackers first breached Leoni's internal servers to study its payment-approval protocol, then compromised the actual email account of a Leoni Germany director, and that when the head of finance sought to confirm the transfer by replying to that same address, per company protocol, the attacker who controlled it simply reconfirmed the request. This breach account is not corroborated by Leoni's own disclosures, by any other outlet, or by the DGAP-Adhoc filings; see Defenses for how the two conflicting accounts are weighed.

The lure and the tell

The lure was authority impersonation: emails crafted to look like they came from genuine senior Leoni AG executives in Germany, instructing the Romanian subsidiary's finance staff to execute an urgent, high-value wire transfer. The classic tells present in this style of attack, reconstructed from the reporting since Leoni never published the exact email text, are hallmarks of CEO fraud: urgency and confidentiality framing that discourages the recipient from verifying through normal channels, a request crafted to mimic Leoni's actual internal wire-approval habits closely enough to pass a casual check (per Softpedia, the email was crafted to take Leoni's internal approval procedures into account), targeting of a remote subsidiary finance team less likely to have direct personal relationships with headquarters executives to sanity-check an unusual request, and reliance on the recipient's assumption that a message "from the CEO" carries binding authority without independent out-of-band callback verification. Per the minority, uncorroborated Evenimentul Zilei account, even the one verification step the finance director did take, replying to ask the German director to confirm, was defeated because the reply went back to the same compromised or attacker-controlled address.

Outcome

Leoni AG publicly confirmed the approximately EUR 40 million loss via a German ad hoc (Wertpapierhandelsgesetz/MAR Article 17) disclosure on 16 August 2016, and confirmed on 14 September 2016 that the loss would fully weigh on Q3 and full-year 2016 EBIT, cutting its FY2016 EBIT forecast from EUR 105 million to EUR 65 million. Leoni stated its IT infrastructure and data security were unaffected, filed a police report, and referred the case to Romanian prosecutors (escalated to DIICOT, Romania's organized-crime/terrorism directorate, given the sum involved). By late 2017, Romanian judicial-source reporting indicated investigators had run out of solid leads and the perpetrators remained unidentified; no arrests or criminal indictments of the fraudsters were found in public reporting. Leoni recovered approximately EUR 5 million from insurers in March 2017, with further claims still being clarified at that date, leaving the bulk of the loss unrecovered; its chief financial officer said the company did not expect to get the money back substantially. Internally, the board dismissed four employees over the case and issued a formal warning to a managing director responsible for personnel matters. Three of the four came from the Bistrița finance department, including its head, and the fourth was the subsidiary's general director, dismissed in February 2017. Leoni said at the same time that there was no indication any employee had been involved in the criminal scheme, and that whether it would bring damages claims against the four depended on the outcome of the prosecutors' investigation. Litigation involving finance staff ran the other way: two dismissed employees, the former general director and a finance-department employee who reported to the department head, sued Leoni to overturn their dismissals. No source records Leoni bringing any action against the head of the local finance department. In October 2021 the Cluj Specialized Tribunal ordered the former general director to pay Leoni EUR 33,646,659.78 in damages, a first-instance ruling both sides could appeal. Romanian reporting rounds that to about 80 percent of the sum defrauded; measured against the approximately EUR 40 million Leoni disclosed, it is closer to 84 percent. By November 2023, per Romanian press (Gazeta de Bistrița), the Cluj Court of Appeal had upheld that damages ruling (while separately ordering Leoni to refund the former general director's court filing fee), with at least one related suit brought by Leoni against the former general director still pending and a further hearing set for 2024. Per a June 2024 Gazeta de Bistrița report, Leoni then withdrew both of the further civil suits it had brought against the former general director in 2022, one at the Cluj Tribunal and one at Bistrița-Năsăud, and neither withdrawal was appealed. That closed out the additional claims without disturbing the EUR 33.6 million judgment, which stands. This civil litigation over internal-control accountability at the local subsidiary is distinct from the criminal fraud investigation, which as of the last reporting found had not identified or charged the actual perpetrators.

Why it matters

This is one of the largest publicly confirmed CEO-fraud/BEC losses on record and a textbook case for the "fake-executive wire fraud" variant of whaling: per Leoni's own official account, no network was breached, no malware was used, and no credentials were stolen (though one uncorroborated Romanian minority account disputes this). A determined attacker succeeded largely by impersonating authority and exploiting the payment-authorization gap at a remote subsidiary finance function, extracting a sum large enough to force a public earnings-guidance cut at a MDAX-listed company. It demonstrates that BEC/CEO-fraud risk scales with organizational complexity (multinational subsidiaries, cross-border finance operations) and that technical security posture can be irrelevant if human verification processes for high-value wire instructions can be bypassed by a sufficiently convincing impersonation. Leoni's own later finding, that misconduct and rule violations by some employees facilitated the frauds, sharpens that point rather than softening it: the controls that failed were procedural ones the company already had. The three-week duration is the other half of the lesson, and the half most retellings drop. This was not one clever email that got past one person in a single moment. It was a sustained run of transfers, mostly single-digit millions each, that nobody inside the company questioned while it was happening.

Defenses

Leoni's own account of what it did came in two stages, and only the first is a holding statement. In its August 2016 ad hoc disclosures the company confirmed its IT infrastructure and data security had not been compromised, framing this as a social-engineering and process failure rather than a hack, launched an internal investigation, reported to police and prosecutors the same day, and began assessing insurance claims, recovering roughly EUR 5 million in March 2017. Seven months on it said considerably more. At the annual results conference on 23 March 2017, the chief financial officer reported that internal investigations had found that misconduct and rule violations by some employees had facilitated the frauds, and that Leoni had responded by examining its payment processes, training staff, and reviewing its internal control system. That changes the lesson. The company's own conclusion is not that nothing could have caught this, but that rules already in place were not followed and that the payment workflow and the control system around it both needed rework. Leoni paired that finding with the statement that it had no indication any employee was involved in the criminal scheme, and both halves belong in the record: a control failure is not the same as complicity. Note: one Romanian outlet (Evenimentul Zilei, September 2016, citing anonymous DIICOT-Cluj judicial sources) published a conflicting minority account claiming attackers first breached Leoni's internal servers and cracked/took over the German general director's actual email account before requesting the transfer, meaning a real intrusion rather than pure impersonation. This directly contradicts Leoni's official "IT infrastructure and data security were not affected" statement. It was not corroborated by any other outlet, by Leoni's own disclosures, or by the DGAP-Adhoc filings, so this record follows Leoni's official framing as the more authoritative, better-corroborated account, while flagging the minority claim here. The incident is widely cited in industry training as the canonical argument for: mandatory dual-authorization / four-eyes callback verification on any wire transfer above a threshold, using a pre-agreed out-of-band channel (phone to a known number, not one in the email) to verbally confirm any executive-originated payment instruction, extra scrutiny on last-minute urgent/confidential transfer requests that bypass normal approval chains, and centralizing or capping the authority of remote subsidiary finance staff to move large sums without independent sign-off from headquarters treasury. The three-week duration adds a control the standard retelling leaves out: monitor outbound payments in aggregate, by velocity and cumulative value over a rolling window, because a run of individually unremarkable transfers is precisely what a per-transaction threshold is built to pass. Leoni's subsequent civil damages litigation against the former general director of the Bistrița subsidiary underscores that internal control and oversight gaps at the local finance function were treated as a contributing failure alongside the external fraud.