ANCHORAGE, AK – Afognak Native Corporation announced today that it has recovered nearly all of the stolen funds that were fraudulently obtained by an international criminal ring during a sophisticated cyber crime attack against the corporation in May 2015.
Approximately one year ago, Afognak’s wholly-owned subsidiary, Alutiiq, LLC, was the victim of a well-coordinated “spear phishing” and social engineering criminal attack, which resulted in an unauthorized wire transfer of $3.826M to a bank account in Hong Kong. In coordination with the FBI, KeyBank, Hong Kong police and legal counsel, Afognak diligently pursued fund recovery. Investigators confirmed that the attack was perpetrated by assailants residing in Asia and Eastern Europe. In December 2015, Afognak obtained a default judgement in Hong Kong against the perpetrators for the full $3.826M.
On March 31, 2016, HSBC (Hong Kong and Shanghai Bank Corporation) returned $2.565M to Afognak. The corporation will recover an additional $1.1M in April, successfully negotiated as a settlement with its fiduciary liability/crime insurance carrier. Combined, Afognak has recovered $3.665M of $3.826M in stolen corporation funds. Afognak will continue to pursue collections against those who committed the crime for the additional $1.26M authorized by the courts.[xyz-ihs snippet=”adsense-body-ad”]
The Afognak Native Corporation is an Alaska Native ANCSA village corporation, serving the Kodiak Alutiiq people of Afognak and Port Lions, Alaska. “We were pleased to report to our Shareholders that we successfully recovered nearly all of the funds that FBI officials told us we had a less than 10% chance to recover,” stated Greg Hambright, Afognak’s President/CEO. “As criminals become more creative in their schemes to steal from companies, we hope that through our transparency that our story will make other corporations and individuals more aware of their own vulnerabilities to these kinds of attacks.”
In the wake of this theft, Afognak took immediate steps to strengthen its protocols governing the authorization of wire transfers, and implemented staff training on social engineering threats. The Information Technology (IT) systems of both Alutiiq and Afognak were not compromised during this event. Further, the company’s computer networks had no breach of any kind, at any point, and all company and customer data remain secure.
The timing of the attack coincided with a shareholder meeting in Port Lions, AK, where Afognak’s senior management team was off‐site from company headquarters. Taking advantage of this time-frame, the criminals established a European‐based email address that “spoofed” (or mirrored) the same address as Afognak’s CEO. Under this false pretext, the criminals sent an email to Alutiiq’s Controller directing the representative to receive and implement instructions for a confidential transaction by a co‐conspirator, who contacted the Controller by phone minutes after the falsified email was sent. During that call, the co‐conspirator, impersonating himself as an attorney, requested the urgent transfer of $3.826M in company funds for purchase of a new subsidiary in a state that senior management had recently visited. The entity was later revealed to be a fictitious third party company based in Hong Kong. When Afognak discovered a crime had taken place, it took quick action to notify its corporate bank and report the incident to the FBI, which enabled the majority of the funds to be frozen and later recovered.[xyz-ihs snippet=”Adversal-468×60″]
