Cyber Security Awareness Month: 5 Horror Stories from the Boardroom

On 29 January 2024, a finance employee in the Hong Kong office of a multinational company went to the police. By then, HK$200 million (about US$25.6 million) had already left the company in 15 transfers to five local bank accounts.

The instruction had come from the company's UK-based chief financial officer, or so the email said. The employee's first instinct was right: a message about a secret transaction looked like phishing. Then he was invited to a video call. The CFO was on it, and so were colleagues he recognised. Every one of them, Hong Kong police said later, was a deepfake.

October is Cybersecurity Awareness Month, and the European Cybersecurity Month opened this year at the Court of Justice of the EU on 25 September with a programme on geopolitical threats and the human factor. The five cases below are real, dated and board-level. Only one of them ended with nothing lost.

1. The video call where every face was fake

Hong Kong, January 2024. The fraudsters built their deepfakes from video and audio of the executives that was already public online. According to the police officer who led the briefing, the deepfake videos were pre-recorded and involved no dialogue with the victim. They delivered instructions; they did not take questions.

That detail is the whole story. A deepfake made from public footage can show you a face and play you a voice. It cannot answer a question it was never trained on. One unscripted question to the "CFO" would have broken the call.

If you sit on the board of a listed company, the raw material for this attack is already out there: earnings calls, AGM webcasts, conference panels, interviews. Hong Kong police's advice afterwards was plain. Confirm business requests through your usual channels, and become suspicious the moment money enters the conversation.

2. The €54 million email that cost a CEO his job

Austria, December 2015 to December 2021. Between 22 December 2015 and 13 January 2016, an employee in the finance department of an Austrian listed aerospace supplier received emails that appeared to come from the company's leadership. They concerned an acquisition abroad. She transferred €54 million to foreign accounts, close to a tenth of a year's revenue.

This is CEO fraud, also called a fake president scam: business email compromise aimed at whoever can move money. When the company disclosed it on 20 January 2016, its shares fell almost 17% in a day. It managed to block €10.9 million.

Then the board acted. The chief financial officer was removed in February 2016. On 24 May 2016, after a 14-hour meeting, the supervisory board removed the CEO with immediate effect, concluding that he had severely violated his duties. In December 2018 the company sued both former executives for €10 million, arguing they had failed to set up an adequate internal control system.

On 27 November 2019, the regional court in Ried found that the former CEO had not breached his duty of care. Austria's Supreme Court upheld the ruling, and a later attempt to raise the claim to €43 million was dismissed in December 2021.

Would one call back to the CEO, on a number already on file, have saved the money? Probably. But that is not what the case was about. The company's claim was about controls, not questions, and it lost.

A fraud, a fired CEO, three years of litigation, and no one held liable. Keep that verdict in mind: story four comes back to it.

3. The remote portal nobody had locked

United States, February to May 2024. On 12 February 2024, criminals logged in to a remote-access portal at a US healthcare payments business using stolen credentials. The portal had no multi-factor authentication (MFA), even though MFA was a requirement across the parent group, as its CEO later told the US Senate Finance Committee. Nine days later, the attackers deployed ransomware.

On 1 May 2024, the group's CEO testified to Congress that he had authorised a $22 million ransom payment. "The decision to pay a ransom was mine," he said. The group had already put the cost of the attack at $872 million in the first quarter alone.

This is the story that argues against everything else in this article. No question, however clever, would have stopped it. A phone call cannot verify a stolen password; only the control can. And a board that had approved an MFA policy had no way of seeing that one portal had been left without it.

4. The law that rewrites story two

Europe, January 2023 to October 2026. On 1 October 2026, Austria's national NIS2 law, the NISG 2026, came into force. The country where a court cleared a defrauded CEO in 2019 now applies a different test to the boards of companies in scope.

Under Article 20(1) of the NIS2 Directive, the management bodies of essential and important entities must approve their organisation's cybersecurity risk-management measures, oversee how those measures are implemented, and can be held liable for infringements. Article 20(2) requiresboard members to follow cybersecurity training. For essential entities, where other enforcement measures have failed, Article 32(5) allows authorities to request a temporary ban on a person exercising managerial functions at CEO or legal-representative level.

In 2019, the court's question was whether one executive had met a general duty of care. For an in-scope company today, the questions are narrower and harder to argue with. Did the board approve the measures? Did it oversee them? Did its members train? Those questions are answered with evidence: board minutes, board packs, attendance records. National corporate law still decides who pays, so nobody can say how the Austrian case would end today.

As of October 2026, 24 of the 27 EU member states had a NIS2 law in force; France, Ireland and Spain did not, and in July 2026 the European Commission referred four countries to the Court of Justice for late transposition. Outside the EU, NIS2 had not yet been incorporated into the EEA Agreement, which is what would bring it to Norway. For cyber security governance, the direction is the same everywhere: the board, not the IT department, answers for it.

5. The deepfake CEO who couldn't name a book

Italy, July 2024. Mid-morning on a Tuesday, an executive at an Italian luxury carmaker started receiving messages on a consumer messaging app that seemed to come from his CEO. They hinted at a large acquisition. The number was not the CEO's usual one, though the profile picture showed him in front of the company logo.

Then came a call. The voice reproduced the CEO's southern Italian accent convincingly. The executive noticed slight mechanical intonations, told the caller he needed to identify him, and asked one thing: the title of the book the CEO had recommended to him a few days earlier.

The line went dead. The company opened an internal investigation, and the attempt became public when Bloomberg reported it on 26 July 2024.

The defence cost nothing and needed no software. It worked for the reason the Hong Kong call would have failed: a fraudster can collect a face and a voice, because both are public. He cannot collect a conversation two people had last week.

The question to bring to your next board meeting

Since AI cannot be trained on something it doesn't have the answer for. Your board members should come up with a security question and answer when fielding suspicious requests. For example, "What is our book title?"

Come to an agreement on how any urgent request involving money, data, or secrecy gets verified. A call back on a number already on file. A second approver. A question only the real person could answer. Then write the decision into the minutes, so that the next time someone asks whether the board oversaw its cyber risk, the answer is on paper.

Frequently asked questions

When is Cybersecurity Awareness Month?

Every October. In Europe it runs as the European Cybersecurity Month (ECSM), supported by ENISA and the European Commission since 2012. In the United States, Cybersecurity Awareness Month dates back to 2004 and is led by CISA and the National Cybersecurity Alliance.

What is the difference between CEO fraud and a whaling attack?

A whaling attack is phishing aimed at senior executives themselves, for example to steal a director's login or board papers. CEO fraud runs the other way: criminals impersonate a senior executive to push an employee into paying or sharing something. Both are forms of business email compromise, and both now arrive by voice and video as well as email.

How much does business email compromise cost?

The FBI's Internet Crime Complaint Center recorded about $3.05 billion in reported business email compromise losses from 24,768 complaints in 2025, according to its annual report published in April 2026. These are US figures and only cover cases that were reported.

Are board members personally liable under NIS2?

They can be. Article 20 of the NIS2 Directive says members of management bodies of essential and important entities can be held liable for infringements, under rules each member state sets in its national law. For essential entities, authorities can also request a temporary ban from managerial functions at CEO or legal-representative level.

Does NIS2 apply to companies in Norway?

Not yet. As of October 2026, NIS2 had not been incorporated into the EEA Agreement. Norwegian companies that operate in, or supply, in-scope entities in EU member states can still be affected through those relationships. [VERIFY]

Can a board portal stop deepfake fraud?

Not on its own. A secure board portal keeps board communications and documents in one controlled channel, which makes out-of-channel requests easier to spot. Verifying that a caller is who they claim to be is still a human step, best agreed by the board in advance.