Phishing Documented incident

Ubiquiti's $46.7M business email compromise (2015)

In 2015, fake emails from Ubiquiti's CEO and a real London lawyer got its finance chief to wire $46.7M. How it happened, the tells, and what was recovered.

Social Engineering Examples·7 sources

The Ubiquiti business email compromise cost the networking company $46.7 million in 2015. Over two weeks, emails pretending to come from its CEO and from a real London lawyer at Latham & Watkins talked its own finance chief into sending 14 wires out of its Hong Kong subsidiary. No system was hacked. Ubiquiti got $16.7 million back and never recovered the remaining $30 million. Status: Documented incident.

Key takeaways

The story was a secret acquisition. Secrecy is what stopped the officer from checking with anyone.
The "lawyer" wrote from a generic @consultant.com address, not a Latham & Watkins one. That was the clearest tell.
Ubiquiti only found out when the FBI emailed its CEO.
Its audit committee found no insider involvement and no network intrusion, but the company reported three material weaknesses in its financial controls.

How the Ubiquiti scam happened

19 May 2015: an email that looked like it came from a senior Ubiquiti executive told the officer serving as principal financial officer and controller about a confidential acquisition. Payments would be handled under the direction of a named partner in Latham & Watkins' London office.
The second persona. Follow-up emails carried that partner's signature and the firm's details. The partner is real. He was impersonated too.
Urgency. The first payment was wanted the same day.
It looked routine. International wires from the Hong Kong account were normal business, and this officer had authority to send them.
14 wires, 20 May to 5 June, totalling $46,703,232 from the subsidiary's HSBC Hong Kong account to accounts held by several entities in places including Russia, Hong Kong, China, Hungary and Poland.

None of this needed malware. According to Ubiquiti's letters to the SEC, the scammers spoofed identities rather than taking over the executive's real mailbox.

The tells that were there

A Latham & Watkins partner writing from an @consultant.com address.
A "deal" nobody else in the company seemed to know about.
Payees Ubiquiti had never dealt with.
Pressure to pay fast and keep quiet.

Tip: treat "this is confidential, don't tell anyone" as a reason to verify, not a reason to skip it. A real acquisition survives a phone call to the CEO.

What it cost Ubiquiti

Item	Amount	Source
Taken in 14 wires	$46,703,232	Letter to SEC staff
Recovered by 30 June 2015	$8.1 million	FY2015 10-K
Charge taken in Q4 FY2015	$39.1 million (net of the $8.1M, plus professional fees)	FY2015 10-K
Court-ordered recovery in fiscal 2016	$8.6 million	10-Q, Dec 2015
Total recovered	$16.7 million	FY2018 10-K
Still outstanding, called "likely remote"	$30.0 million	FY2018 10-K

Beyond the money, the officer who held wire authority resigned, FTI Consulting supplied an interim chief accounting officer, and Ubiquiti tightened its controls. No one was publicly identified or charged in its filings.

Timeline

Date	Event
19 May 2015	First fake executive email about a secret acquisition
20 May to 5 June 2015	14 wires go out from the Hong Kong subsidiary
5 June 2015	The FBI's San Francisco office warns the CEO; fraud discovered
6 August 2015	Ubiquiti discloses it in an 8-K filing
Fiscal 2016	$8.6 million recovered under a court order; nothing more after that

What would have stopped it

A callback on a known number for any new, large or urgent wire, whoever seems to be asking.
Two people to approve international transfers, with limits per payment.
Checking the sender's domain. A law firm doesn't email from a free-webmail-style address.
Email authentication (SPF, DKIM, DMARC) and look-alike domain monitoring.
A no-blame way to pause. Staff need to know they won't be punished for delaying a "CEO" request to check it.

Common questions

How much did Ubiquiti lose to the BEC scam?

$46.7 million was wired out in 2015. Ubiquiti recovered $16.7 million in total, leaving about $30 million it described as likely unrecoverable.

Was Ubiquiti hacked?

No. Its audit committee found no evidence of a network intrusion or of employee complicity. It was impersonation by email.

Who was impersonated?

A senior Ubiquiti executive and a real partner at the law firm Latham & Watkins in London. The lawyer was a victim of the impersonation, not part of the scam.

How was the fraud discovered?

The FBI's San Francisco office emailed Ubiquiti's CEO on 5 June 2015 to warn that money may have been taken from the Hong Kong account.

Sources

Form 8-K, Ubiquiti Networks, Inc. (Aug 6, 2015). BEC fraud incident disclosure. U.S. Securities and Exchange Commission (EDGAR) (primary). First-party 8-K stating June 5, 2015 discovery, $46.7M transferred, $8.1M recovered, an additional $6.8M under legal injunction, and ineffective ICFR due to one or more material weaknesses
Ubiquiti Networks correspondence to SEC staff. facts and circumstances of the $46.7M fraudulent transfer. U.S. Securities and Exchange Commission (EDGAR) (primary). Richest primary detail: 14 wires totaling $46,703,232 from May 20 to June 5, 2015, opening email May 19; impersonation of the CEO and of a real Latham & Watkins partner in the London office, sent from an @consultant.com account; the company's then principal financial officer and controller authorized the payments; the FBI alerted the CEO first
Form 10-K for fiscal year ended June 30, 2015. BEC fraud loss disclosure. U.S. Securities and Exchange Commission (EDGAR) (primary). Annual report describing the $46.7M fraud, $8.1M recovered, a $39.1M Q4 charge including professional service fees, and three material weaknesses, the first two of which caused the failure to prevent and detect the fraud
Form 10-Q for quarter ended Dec 31, 2015. Note 14 Business Email Compromise Fraud Loss. U.S. Securities and Exchange Commission (EDGAR) (primary). Details the single $8.6M court-ordered recovery, the resulting net fiscal 2016 recovery, and the remaining $30.0M
Form 10-K for fiscal year ended June 30, 2018. Business email compromise fraud risk factor. U.S. Securities and Exchange Commission (EDGAR) (primary). Latest statement of the recovery total: $16.7M recovered in all, no additional recoveries since fiscal 2016, $30.0M still outstanding
Tech Firm Ubiquiti Suffers $46M Cyberheist. KrebsOnSecurity (secondary). Corroborating security-press coverage framing the incident as CEO-fraud/BEC
Ubiquiti Networks Says It Was Victim of $47 Million Cyber Scam. NBC News (secondary). Mainstream corroboration of figures and disclosure

Cite this case

Social Engineering Examples. “Ubiquiti's $46.7M business email compromise (2015)”. Accessed 3 November 2026. https://socialengineeringexamples.com/ubiquiti-networks-bec-2015

Attack Chain & Defense

1Reconnaissance and target mapping

What happened

the fraud ring likely identified Ubiquiti's Hong Kong subsidiary, the officer who held wire authority over its bank account (the company's principal financial officer and controller), and the CEO's identity through OSINT sources such as corporate filings, the company website, and professional-networking profiles, consistent with how BEC operators typically map finance-department roles and reporting lines before contact.