Social engineering. CEO fraud of 9 million euros in the phishing scam to the biopharmaceutical company Zendal

Hacker Steals €9 Million from Spanish Pharmaceutical Company via CEO Fraud

Incident Overview
A hacker has scammed more than €9 million from the Zendal pharmaceutical group in Galicia, Spain, using a CEO Fraud scheme. The attacker posed as a senior manager to authorize multiple bank transfers in his own name.

Attack Method

• Technique: Phishing with forged sender identity.
• The hacker impersonated a top executive to deceive the CFO into making several transfers.
• The scam went unnoticed until the company began to experience liquidity issues.
• Upon contacting the real manager, the CFO discovered the transfers had never been authorized.

Context

• Zendal is one of Spain’s leading biotechnology companies, currently preparing to produce hundreds of millions of COVID-19 vaccine doses.
• The company has filed a complaint with the Civil Guard, and investigations are underway to trace the money and identify those responsible.
• Zendal has stated that it will not make further public comments until the investigation concludes and will continue work on vaccine production.

Impact
This incident highlights how social engineering — particularly CEO Fraud — can cause devastating financial losses even in large, well-established organizations.

Key Takeaway
It is essential to train employees on the multiple forms of social engineering attacks and ensure strong verification processes for financial transactions.