For businesses in the architecture, engineering, and construction (AEC) industry, cybersecurity might not always feel like a top priority. But a recent phishing attack highlights how relying on a single security measure, like MFA, can leave businesses vulnerable to sophisticated scams.

This blog explores what went wrong, why it mattered, and actionable steps your company can take to protect against similar threats.

 

Key Lessons from the Incident

1. MFA Alone is Not Enough Without Context-Aware Features

  • What Happened: A cybercriminal exploited human error by sending a fake Microsoft 365 authentication prompt. Distracted during a meeting, the business owner approved the request without realizing it was fraudulent.
  • Impact: The attacker gained access to sensitive email accounts, enabling them to send fraudulent wire transfer instructions to a client.
  • How to Prevent It:
    • Utilize the Microsoft 365 app authenticator which forces an employee to enter a number as opposed to quickly tapping yes to a notification.  
    • Rely on a service provider that actively monitors and assesses Microsoft risky sign-ins, quickly and efficiently evaluating login location, device, and timing to detect suspicious activity. 
    • Train employees to recognize and question unexpected authentication requests. 
    • Establish policies requiring verification for any unusual login attempts flagged by MFA. 

2. Real-Time Monitoring Could Have Prevented Escalation

  • What Happened: After gaining access, the attacker operated undetected, sending fraudulent wire instructions that resulted in $100,000 being transferred to their account.
  • Impact: The lack of monitoring tools allowed the scam to escalate without detection.
  • How to Prevent It:
    • Deploy real-time monitoring tools to detect unusual login behavior or email activity.
    • Set up automated alerts for high-value transactions or unusual patterns in communication.
    • Regularly audit system activity to identify anomalies and respond proactively.

3. Integrated Security Systems Are Critical

  • What Happened: The attacker used the compromised email account to execute their scheme, highlighting a lack of integration between email and endpoint security systems.
  • Impact: The absence of coordinated security measures made it impossible to flag anomalies like high-risk wire transfer requests or unauthorized access.
  • How to Prevent It:
    • Use AI-powered email filtering tools to identify suspicious requests and block malicious links.
    • Deploy Endpoint Detection and Response (EDR) systems to monitor and isolate compromised devices.
    • Integrate email, endpoint, and network security systems for a comprehensive defense strategy.

4. Financial Verification Protocols Could Have Stopped the Fraud

  • What Happened: The client trusted the fraudulent wire instructions and acted without verifying their authenticity.
  • Impact: The lack of a multi-step financial verification process allowed the scam to succeed, resulting in significant financial and reputational damage.
  • How to Prevent It:
    • Require multi-step approval for all high-value financial transactions.
    • Use secure communication channels, like encrypted messaging or phone calls, to confirm wire transfer instructions.
    • Implement clear policies requiring secondary verification for any payment requests outside normal workflows.

 

Quick Checklist: Cybersecurity Essentials for AEC Businesses

  1. Enhance MFA with Context-Aware Features: Use tools that analyze login behavior to identify anomalies. 
  2. Monitor and Respond in Real-Time: Deploy tools that flag unusual login activity, email patterns, or financial requests. 
  3. Integrate Security Systems: Ensure email, endpoint, and network security systems work together seamlessly. 
  4. Verify Financial Transactions: Require multi-step approvals and secure channels for all high-value payments. 
  5. Train Employees: Conduct regular phishing awareness sessions and simulated attacks to build a culture of cybersecurity vigilance. 

 

Why AEC Businesses Must Act Now

The AEC industry’s reliance on high-value financial transactions and collaboration across multiple stakeholders makes it a prime target for cybercriminals. Small and medium-sized businesses are particularly vulnerable because they often lack the resources to implement robust cybersecurity measures.

The consequences of a breach go beyond financial loss—it can erode trust, damage your reputation, and disrupt your projects. Proactive measures like advanced MFA, monitoring tools, and financial verification protocols can make the difference between a thwarted attack and a devastating incident.

 

Protecting Your Business

Every AEC business faces unique cybersecurity challenges. By implementing the right tools, processes, and training, you can build a strong defense against evolving threats.

Partnering with the right IT provider can help you navigate these challenges with tailored cybersecurity strategies designed for your industry. Cybersecurity isn’t just about technology—it’s about safeguarding the trust and integrity that your clients and projects rely on. Start protecting your business today.

Share:

View Archives