Case study: Kennedy’s Confections, a victim of spear phishing

Spear phishing attacks
Spear phishing attacks

Kennedy’s Confections is a family-run chocolate and confectionary magazine based in Kent. SME spoke to owner Angus Kennedy, who is also known for giving talks on the world of confectionary and eating chocolate for a living.

At the end of last year, a criminal gang faked Kennedy’s identity, posed as him by emailing his accounts department, and had them transfer two direct bill payments amounting to just under £30,000.

• What action did you take immediately after discovering the loss?

I called the insurance company first and they said it wasn’t covered. The bank said it was non-recoverable and the police said they were looking into it. Basically, the money has gone. No one really seems to care.

I immediately started to cancel any direct debits and it was and still is ‘essential spending only’. I remember last month I had a pile of invoices and not enough cash to pay them. You have to stay cool. On the day it happened I went to the gym and attacked the punch bag. That really helped.

• Could it have been prevented?

Well yes, I should not have given my staff so much trust and authority. I should have made it so that they simply were unable to make such large payments. I should have made it so that any payment over £5,000 required two signatures.

• Have there been any other associated challenges?

We had three resignations. We used to have seven people four months ago and now I have two employees rattling about.

I think running a business is a challenge as it is anyway. So this is just slightly more challenging than usual, but you are still doing the same old things. When there is a crisis you just do more of what you did anyway: selling, serving, chasing the cash and doing it again day after day until you are done.

• What would your top tips be for SMEs when it comes to fraud/cybercrime?

Everyone focuses on virus software, but to be honest this was someone faking my email address. Anyone can do it. Be vigilant and always make sure you employ the most professional, qualified people you can afford.