John Mc Loughlin, Group CEO and UK Sales Director at J2. (Image: AI-enhanced)
The investment firm was not hacked through its trading platform, no crypto-currency exchange was compromised and no sophisticated financial system was breached. The attackers compromised Microsoft 365, quietly took control of the conversation and let the firm authorise the payment itself.
By the time anyone realised the e-mails were fake, US $1.5m crypto-currency investment had already disappeared.
The deception worked because the conversation looked legitimate. The criminals gained access to the firm's Microsoft 365 environment and used Outlook rules to intercept messages relating to the planned investment, alter details and send communications back to the firm.
Small changes to e-mail addresses were difficult to notice, particularly when the sender's display name appeared more prominently than the actual address. The firm believed it was continuing a legitimate conversation with its investment counterparty.
A test crypto-currency transfer was made and the attackers confirmed receipt, after which the firm was instructed to transfer the remainder of the investment. It did so, believing the funds were going to the legitimate company.
The fraud only became apparent when the genuine investment company contacted the firm to ask when the money would be sent. That was when both sides discovered they had effectively been conducting two separate conversations without realising it.
The incident reflects a wider concern across the investment sector. KPMG's March 2026 Wealth and Asset Management Risk and ICARA Benchmarking Survey found that 92% of UK asset managers ranked cyber risk among their top five risks, up sharply from 52% the previous year, while 41% identified it as their single biggest threat. The survey covered 39 firms responsible for £8.7 trillion in assets. For this business, however, cyber risk had already moved from a boardroom concern to a direct financial loss.
The firm removed the unauthorised Outlook rules and began investigating the compromise before bringing in J2 to examine the wider Microsoft 365 environment. The cyber security team locked down the mailboxes, addressed misconfiguration across the tenant and strengthened access controls, while additional security and conditional access controls were introduced through J2's Advanced Security Monitoring Service to identify unusual activity and potential account takeover.
The work extended beyond e-mail. Through the J2 Cyber Resilience Framework, the team introduced layered measures covering e-mail security and compliance, managed backup, endpoint and mobile protection, as well as Managed Detection and Response from the J2 Cyber Security Centre.
For a small investment business operating entirely remotely, this visibility was particularly important because there was no conventional office or dedicated internal IT department. Microsoft 365 was effectively the communication layer connecting its people, information and financial decisions.
The company subsequently retained J2 to manage its Microsoft environment and provide ongoing security support, replacing a part-time resource with specialist expertise and continuous oversight.
“I know that simply adding security tools does not give you security,” says John Mc Loughlin, Group CEO and UK Sales Director at J2.
“The only way to prevent damage in the modern world is to have visibility because you cannot protect what you cannot see. J2's cyber resilience focused services provide that visibility, and visibility gives us the capability to respond.”
The technical breach was contained, but the financial consequences have proved considerably harder to resolve. More than a year later, recovery of the crypto-currency remains a legal process and the firm is still pursuing the funds.
The case demonstrates that an email account can effectively become part of a company's financial infrastructure: when major transactions depend on trusted conversations, protecting those conversations means understanding what is happening across the environment, spotting unusual behaviour and responding quickly enough to stop a compromised conversation becoming a costly transaction.