Cyber attack believed to have originated in Hong Kong

Arup has confirmed that it was the victim of a deepfake fraud after an employee was duped into sending HK$200m (£20m) to criminals by an artificial intelligence-generated video call.

Arup said that at the beginning of the year it had “notified the police about an incident of fraud in Hong Kong”. It confirmed that fake voices and images were used.

Hong Kong police said in February a worker at a then-unnamed company had been tricked into transferring money by people on a hoax call “posing as senior officers of the company”.

cyber

Source: Shutterstock

The scam involved using fake voices and images. Arup said the frequency and sophistication of deepfake and cyber-attacks was on the rise

In its statement, Arup added: “Back in January we notified the police about an incident of fraud in Hong Kong. Unfortunately, we can’t go into details at this stage as the incident is still the subject of an ongoing investigation.

“Our financial stability and business operations were not affected and none of our internal systems were compromised.”

Arup global chief information officer, Rob Greig, who oversees the company’s computer systems, said the organisation has been subject to attacks before with their frequency and capability rising in the past few months.

“Like many other businesses around the globe, our operations are subject to regular attacks, including invoice fraud, phishing scams, WhatsApp voice spoofing and deepfakes. What we have seen is that the number and sophistication of these attacks has been rising sharply in recent months,” he said.

Greig said he hoped that Arup’s experience would “raise awareness” of the increasing sophistication of cyber attackers. He added: “This is an industry, business, and social issue, and I hope our experience can help raise awareness of the increasing sophistication and evolving techniques of bad actors.” 

The Hong Kong police force said an employee had been “deceived of some HK$200m after [they] received video conference calls from someone posing as senior officers of the company requesting to transfer money to designated bank accounts”.

It said no arrests had been made so far but the investigation was ongoing.