This happened to someone I know with a reasonably well-run but not super technical small business. Someone compromised the email account of their accounts receivable person, silently monitored it for a while, and then used it to send a few strategic requests to change the payment account. By the time my friend noticed and politely asked their customers (mid-size businesses all) “Why haven’t you paid this $50,000 bill?”, the hackers had made off with a few hundred thousand - a big deal to my friend, but not so much to law enforcement, who pretty much shrugged and said “Sucks to be you.”<p>Luckily, several of those customers theoretically had policies against changing payment directives without phone confirmation, which were not followed, so they are taking some shared responsibility for this.