Medidata Solutions $4.8M CEO-Fraud Wire Transfer (2014)

What happened

In summer 2014, Medidata told its finance team to be ready to assist with significant transactions on an urgent basis, tied to a possible acquisition. On September 16, 2014, an accounts-payable employee received an email that appeared to come from Medidata's president, complete with his name, email address, and photo in the "From" field. It said an acquisition was near, that it was strictly confidential, and that an outside attorney would contact her. A man posing as that attorney then phoned her demanding an urgent wire transfer, saying a physical check would not suffice because of time constraints. When the accounts-payable employee said she needed presidential authorization plus sign-off from a vice president and the director of revenue, a follow-up group email, again appearing to come from the president, instructed all three to process and approve the payment. The accounts-payable employee entered the payee details the caller supplied into Chase's online banking system, and the two executives approved it; $4,770,226 was wired to an overseas bank account. On September 18 the caller requested a second transfer. The accounts-payable employee initiated it and the director of revenue approved it before anyone objected. Only then did the vice president find the reply-to address suspicious, and the accounts-payable employee composed a fresh email to the president's real address, which is how the company learned he had never made the requests. Medidata contacted the FBI and outside counsel. Investigators found the emails had been spoofed: an unknown actor embedded code so the messages displayed the president's identity while masking the true sender. Medidata disclosed the roughly $4.8M loss in a September 2014 SEC Form 8-K. This is a fully documented, real incident, confirmed by the company's own SEC filing and multiple federal court opinions.

How it worked

The scheme layered three pressures. First, authority and impersonation: emails were crafted so Medidata's Gmail-hosted system displayed the president's name, address, and photo, making them look genuinely internal. Second, a fake external "attorney" added legitimacy and a live, insistent human voice by phone, a classic BEC pattern of pairing a spoofed email with a corroborating caller. Third, secrecy and urgency: the "confidential acquisition" framing discouraged the employee from openly verifying, and the same-day timeline pressured fast action. Crucially, the request landed in a receptive context: finance staff had been told that summer to be ready to assist with significant transactions on an urgent basis, so the fraudulent request fit an expected pattern. Whether the fraudsters knew about that internal briefing is not established anywhere in the record. When the employee's control (needing executive sign-off) kicked in, the fraudsters simply produced another spoofed "presidential" email to satisfy it, turning the internal check into part of the con.

The lure and the tell

Lure: a spoofed email appearing to be from the company president announcing a confidential, urgent acquisition and directing the employee to cooperate fully with an outside attorney, reinforced by that attorney's phone call demanding a wire. Tells: the request bypassed normal process, with a wire demanded because a check would not suffice on the stated timeline, and it leaned on secrecy to prevent verification. The sender address was not a tell, and it is worth being precise about that. The spoofed emails carried the thief's real address only in the SMTP envelope; the district court recorded that recipients "only saw the information in the IMF 'From' field," and the Second Circuit found the messages "inaccurately appeared, in all respects, to come from a high-ranking member" of the company. The one visible anomaly came two days later, in the "Reply To" field of the second request, and even that surfaced only after the second wire had been initiated and approved.

Outcome

The first wire of $4,770,226 was lost. The second was initiated and approved before the vice president raised his doubts, and no second loss was ever recorded. Medidata filed a claim under its $5M Chubb/Federal Insurance "Federal Executive Protection" policy, whose Crime Coverage Section carried computer fraud, funds transfer fraud, and forgery clauses. Federal denied coverage, arguing no hacking occurred and that employees transferred the funds voluntarily. Medidata sued (S.D.N.Y., 1:15-cv-00907). On July 21, 2017 the district court granted summary judgment for Medidata under the computer fraud and funds transfer fraud clauses. Its forgery theory failed: the court held the policy covered only forgery or alteration of a financial instrument, and no financial instrument was involved. Judgment of $5,841,787.37 in damages and interest was entered on August 10, 2017. The Second Circuit affirmed on July 6, 2018 in a summary order, holding the spoofing was a covered computer fraud and the proximate cause of the loss, and expressly declining to reach the other clauses. It rejected Federal's request for reconsideration in August 2018. No perpetrators were publicly identified or charged.

Why it matters

This is an early business email compromise (BEC) case and the reference point in the coverage fight that followed, though it carries less legal weight than its reputation suggests. Two corrections are worth making. The policy was a commercial crime policy, not cyber insurance. And the Second Circuit's affirmance came as a summary order, which states on its own first page that rulings by summary order do not have precedential effect; only the district court opinion is published, at 268 F. Supp. 3d 471.

The attack itself is the durable lesson: no malware and no system breach were needed, because manipulating what recipients saw in the "From" field, plus social pressure, was enough to move millions. The coverage fight mattered because it tested whether "computer fraud" wording reaches spoofing-driven wire fraud where employees themselves push the button. The answer that gets quoted, "larceny by trick is still larceny," is the district court's, and it appears in that court's funds transfer fraud analysis rather than its computer fraud analysis; the Second Circuit declined to reach the funds transfer fraud clause at all. Later courts reading different policy wording have gone the other way. SJ Computers v. Travelers (D. Minn., August 2022) held that a BEC wire loss fell under a policy's social engineering fraud clause and not its computer fraud clause, and Mississippi Silicon Holdings v. Axis (5th Cir., February 2021) denied computer transfer fraud coverage because employees knowingly authorized the transfers. Treat Medidata as persuasive on its own facts and its own policy language, not as settled law.

Defenses

Require out-of-band verification (a known phone number or in-person confirmation) for any wire transfer or change of payee, especially "urgent" or "confidential" executive requests; verification must be independent of the request channel. Treat secrecy demands that discourage checking as a red flag, not a reason to skip controls. Enforce dual-authorization that is genuinely independent (approvers should confirm with the executive directly, not rely on another email). Deploy email authentication (SPF, DKIM, DMARC) and external-sender/lookalike-domain warnings, and flag reply-to addresses that differ from the display sender. Pre-briefing finance staff to expect urgent transfers, as happened here, can backfire; pair any such heads-up with a mandatory verification protocol. One caution drawn from this case rather than recommended by it: the verification that finally worked was not a callback but a fresh email typed to the president's real address. That succeeded only because a new message goes to the genuine address instead of back down the attacker's reply path, and it came after the second wire had already been approved. A call to a previously known number is the stronger control.