When an Email Scam Costs the CEO His Job
Most corporate data breaches damage server infrastructure or customer trust. But in January 2016, a business email compromise attack against Austrian aerospace component manufacturer FACC AG (a critical supplier to Airbus, Boeing, and Bombardier) resulted in the direct termination of both its long-standing Chief Executive Officer and Chief Financial Officer.
The company lost €50 million ($54 million USD) in a classic "Fake President" or "CEO Fraud" social engineering incident.
Key Incident Metric: €50,000,000 lost. FACC shares plunged 17% in a single day, and the supervisory board ousted CEO Walter Stephan after 17 years at the helm.
The Sequence of Events
- The Inbound Spoofed Email: An employee in the accounting department received an email appearing to originate from Walter Stephan, the company's chief executive.
- The Acquisition Narrative: The email claimed that FACC was secretly acquiring an engineering competitor. The employee was instructed to wire funds urgently to an overseas holding account to close the confidential deal.
- Exploiting Hierarchical Authority: In European manufacturing corporate cultures, hierarchical obedience can be deeply ingrained. The employee felt compelled to carry out the executive directive swiftly.
- Fund Dispersal: By the time internal accounting discrepancies were spotted weeks later, €50 million had already been transferred through Slovakia, Romania, and Hong Kong.
The Corporate Fallout
The repercussions extended far beyond the stolen funds:
- Executive Dismissals: In February 2016, the supervisory board terminated the CFO. Three months later, in May 2016, the board voted unanimously to fire CEO Walter Stephan, stating he had "violated his duties" regarding internal financial safety controls.
- Lawsuit Against Executives: In an unprecedented legal move, FACC later sued both its former CEO and CFO for €10 million in damages for failing to establish adequate accounting safeguards against basic phishing scams.
- Stock Collapse: The company took a €41.9 million write-down, transforming an annual profit into a substantial net corporate loss.
Why Technical Firewalls Could Not Prevent It
FACC had enterprise firewalls, antivirus software, and certified IT operations. What it lacked was process resilience against social manipulation:
- The attackers didn't need to infect a computer with malware.
- The email did not contain a suspicious attachment or malicious URL.
- The fraud relied solely on an employee's fear of defying their CEO's direct instruction.
Key Lessons for Corporate Governance
- Decouple Authority from Execution: Even if the CEO personally demands an urgent transfer, accounting systems must require independent secondary board authorization.
- Build a 'Safe to Verify' Culture: Employees must be rewarded — never reprimanded — for stopping an executive request to verify its authenticity through a separate secure channel.
- Empower Employees Through Phishing Drills: Teach every department how spear-phishing works by running realistic simulations tailored to specific corporate roles.