Breaches and incidents
Capillary Technologies (India): EUR 3.04 million lost to payment-diversion fraud at a Czech subsidiary, forensic report filed
Capillary (Bengaluru SaaS, NSE: CAPILLARY) told the exchanges that four payments totalling EUR 3,041,169.90 were made from SessionM Czech Republic s.r.o.
- Disclosed
- Verification
- Checked against a primary source
What happened
- Capillary (Bengaluru SaaS, NSE: CAPILLARY) told the exchanges that four payments totalling EUR 3,041,169.90 were made from SessionM Czech Republic s.r.o. (acquired from Mastercard in Feb 2026) between 26 Jun and 2 Jul 2026; three went to ZZDJB CO LIMITED at HSBC Hong Kong and one to ZHONGXIAN TRADING PTE. LTD at UOB Singapore. Inc42 reports EUR 450,000 was recovered early; Capillary said customer data and technology infrastructure were not compromised.
- Cause per the KPMG forensic summary filed on 31 Oct 2026: impersonation of a senior executive and of an external lawyer, a lookalike domain (law-ogier.co.uk imitating ogier.com), a fake confidential acquisition with NDA and invoices, and off-channel WhatsApp and personal email. KPMG found no malware, mailbox compromise, account takeover or spoofing; deepfake voice or video could neither be confirmed nor ruled out.
- Attacker: unidentified; KPMG did not trace onward funds or beneficiaries.
- Response: forensic audit approved 31 Jul 2026; Capillary says payment controls were strengthened and recovery and legal remedies are being pursued. No CERT-In action stated.