[Update] Forensic Audit Finds External Breach Behind €3 Mn Capillary Fraud

Update | October 31, 19:33 IST

A forensic audit by KPMG has found that the €3.04 Mn banking fraud at Capillary Technologies’ subsidiary SessionM Czech Republic was most consistent with an external payment-diversion scam involving impersonation of a senior executive and an external lawyer.

Capillary, in an exchange filing today, said the fraud likely involved a lookalike email domain, social engineering and communications through WhatsApp and personal email accounts.

The investigation found no evidence of malware, unauthorised access, mailbox compromise, account takeover or traditional email spoofing in the systems and records examined. It also did not identify any evidence of employee involvement. However, the audit could neither establish nor rule out the use of deepfake audio or video, as original recordings, mobile-device data and call records were unavailable.

Of the four disputed transactions, three payments went to ZZDJB CO LIMITED at HSBC Hong Kong, while the fourth was transferred to ZHONGXIAN TRADING PTE. LTD at UOB Singapore.

While the investigation established the initial transfers, it did not trace the subsequent movement of funds, identify the ultimate beneficiaries or assess the prospects of recovery. It also could not independently verify the company’s payment approval processes due to missing bank-portal and workflow records.

KPMG concluded that the incident was primarily a social-engineering-led fraud. Capillary said it has strengthened payment controls and is pursuing recovery efforts and legal remedies.

Update| July 31, 15:15 IST

Days after it announced a cyber fraud of €3 Mn (about ₹32.7 Cr) at one of its step-down subsidiaries, SaaS company Capillary Technologies said it has initiated a forensic audit to investigate the suspected fraudulent and unauthorised banking transactions.

The audit, approved by the company’s Audit Committee, will be conducted by KPMG Assurance and Consulting Services LLP and will examine the transactions, banking processes, internal financial controls, identify the root cause and recommend corrective measures.

“The forensic audit has been initiated with a view to independently examine the facts and circumstances relating to the incident, determine the root cause and recommend appropriate corrective measures,” the company said in its exchange filing. 

Original | July 6, 17: 41 IST

SaaS company Capillary Technologies announced that one of its “recently acquired step-down subsidiaries” has been hit by a cyber-enabled banking fraud, leading to a loss of €3 Mn (about ₹32.7 Cr).

The funds were fraudulently transferred to an unauthorised third-party bank account using advanced deepfake methods including cloning, signature forging, social engineering to impersonate the company’s senior management, Capillary said in an exchange filing. As per the company, the exploit took place just prior to this weekend (before July 3).

Capillary has taken legal and operational measures to safeguard and recover the transferred funds, including working with law enforcement, cybercrime authorities and concerned banks. It further noted that the step-down subsidiary was insured under a cyber and crime insurance policy and the company is also evaluating the extent of insurance coverage and recoverability.

Upon identifying the attack, the company was able to recover €450K. It has also traced bank accounts suspected to be related to the fraud and asked related banks to put the accounts on hold.

“With the swift action by the Company and advice of the relevant local authorities, additional funds were traced, and those accounts have since been placed on hold by the respective banks, reducing the amount at risk. The exact amount currently on hold is yet to be determined,” the company said.

Despite the cyberfraud, Capillary believes that its customer data and the company’s technology infrastructure remains uncompromised.

The SaaS company’s most recent acquisition was global card network MasterCard’s customer engagement and loyalty platform SessionM, which it snagged in February for $20 Mn (about ₹190.7 Cr) to strengthen presence in the North American and Latin American markets.

Besides, the company also acquired Canada-based martech platform Kognitiv for an undisclosed amount last year.

On the financial front, Capillary’s net profit grew multifold to ₹43.4 Cr in Q4 FY26. Its operating revenue also jumped 25% YoY to ₹191.3 Cr in the March quarter. For the full fiscal FY26, Capillary’s profit skyrocketed 296% to ₹52.4 Cr from ₹13.3 Cr in FY25. The top line rose 23% to ₹734.6 Cr from ₹598.3 Cr in the previous fiscal.

Shares of Capillary ended today’s trading session 0.15% higher at ₹515.85.

The incident underscores the growing cybersecurity risks facing enterprises as AI becomes more advanced, highlighting the need for companies to strengthen their defences against increasingly sophisticated cyber threats. Last month, Apple’s supply chain data was reportedly exposed after sensitive supplier lists, component details and alleged images of its upcoming iPhone 18 Pro models surfaced online following a cyberattack on its contract manufacturer, Tata Electronics. 

The post [Update] Forensic Audit Finds External Breach Behind €3 Mn Capillary Fraud appeared first on Inc42 Media.