Vendor Email Compromise is Officially A Big (Seven-Figure) Problem

While the Solarwinds “sunburst” attack brought to light the compromising of a vendor, VEC has been around for some time and now seems to be going mainstream.

I first mentioned Vendor Email Compromise (VEC) back in late 2019. This method of compromising an email account at one company purposely to use it to attack a second company has been quietly evolving over the last 14 months.

New data from Abnormal Security’s report, The Rising Threat of Vendor Email Compromise in a Post-SolarWinds Era sheds light on just how prevalent this attack method is becoming. According to the report:

• Your chance of getting hit with a VEC attack during any given week increased 82% between Q3 of last year and January of this year
• The average cost of a VEC attack is $183K with the largest observed being $1.6М
• Billing account update fraud is the most expensive (on average) at $300K

Vendor email compromise is one of the most dangerous methods of attack because it uses a legitimate email account from a known vendor and (potentially) known person within that company! Users involved with financial transactions need to undergo Security Awareness Training to understand the common scams (e.g. updating banking details on payments) and how to avoid being a victim (by calling the person via phone back at a known-good number to verify the change). Otherwise, VEC looks like it’s going to get costly.