Crooks stole €15 Million from European retail company Pepco

Crooks stole €15.5 million from the European variety retail and discount company Pepco through a phishing attack.

The Hungarian business of the European discount retailer Pepco Group has been the victim of a phishing attack, crooks stole about 15 million euros ($16.3 million). The group operates three distribution lines: Poundland in the United Kingdom, Dealz in the Republic of Ireland and Spain, and Pepco in various European countries.

“Pepco Group (“Pepco” or the “Group”) has been the target of a sophisticated fraudulent phishing attack in its Hungarian business.” reads the press release published by the company. “The attack has resulted in a loss of approximately €15.5 million in cash, before any potential recovery. It is unclear at this stage whether the funds can be recovered, although Pepco is pursuing various efforts through its banking partners and the police. At this stage, the incident does not appear to have involved any customer, supplier or colleague information or data.”

Pepco launched an investigation into the incident with the help of law enforcement. The discount retailer is working with banks in an attempt to locate and freeze the stolen funds, however, it’s still currently unclear whether the funds can be recovered.

The company pointed out that the cyber attack doesn’t involve any customer, supplier or staff information or data.

The Group attempted to reassure its customers and business partners stating it possesses a robust balance sheet, currently having access to over €400 million in liquidity from cash and credit facilities.

“The Group maintains a strong balance sheet with access today to over €400 million in available liquidity (from cash and credit facilities) and continues to generate strong cash flow from its operations. The Group takes financial controls and IT security extremely seriously and is currently conducting a group-wide review of all systems and processes to secure the business more robustly going forward.” continues the press release.

The press release doesn’t provide technical details about the attack, however it was likely victim of a Business Email Compromise (BEC) attack.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Pepco)