Documented social engineering incidents targeting the nonprofit & ngo sector, sourced and fact-checked.
Attackers hijacked a staff email account and used fake solar-panel invoices to trick the US charity into wiring $997,400 to Japan; insurance covered all but roughly $112,000.
DocumentedA compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's account, who later admitted wire fraud.
DocumentedA four-man Manhattan BEC ring used compromised business email accounts to redirect approximately $3.49 million and $2.0 million in wires, then moved funds through additional accounts and Bitcoin.
DocumentedA respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11 transfers and collapsed the bank. Why dual control didn't save it.
Reported/allegedGreenpeace alleged in a civil suit, dismissed in both forums without any finding on the merits, that Dow Chemical and CONDEA Vista Company (bought by Sasol Ltd. in 2001 and sued as Sasol North America, Inc.) had, through two public relations firms, subcontracted the private intelligence firm Beckett Brown International to run repeated trash-collection raids on its Washington DC offices between 1998 and 2000, one subcontractor being a District of Columbia police officer engaged off duty and expected to use his badge to reach a locked trash enclosure.
DocumentedRussian GRU officers spoofed Google security-alert emails with Bitly-masked links to phish 300+ individuals affiliated with the Clinton campaign, DCCC, and DNC, stealing 50,000+ of the campaign chairman's emails after an IT aide's fateful 'legitimate' typo.
DocumentedA compromised Constant Contact mass-mailing account let Russia-linked Nobelium (APT29) send USAID-spoofed phishing emails that funneled roughly 3,000-7,000 accounts across 150-350 government, IGO, and NGO organizations toward an ISO-file/Cobalt Strike infection chain, prompting a joint CISA/FBI advisory (AA21-148A) and a DOJ domain seizure.
DocumentedIn late December 2012, attackers rigged the Council on Foreign Relations website to silently exploit an Internet Explorer zero-day and drop malware.
DocumentedAnthropic says one criminal used Claude Code to breach 17 organisations, price ransoms from their own books and write the notes. Demands hit $500,000+.
Social Engineering Examples