A Real Pattern, Anonymized

The details below come from cases brought to us by organizations in British Columbia. Names, industries and dates are removed. The sequence is what matters, because we see it again and again.

Email takeover attack chain Five steps: a supplier mailbox is compromised, the attacker registers a look-alike domain, sends phishing to management in a staff member's name, takes over an executive mailbox, then changes invoices and bank details. 1. Supplier mailboxcompromised by phishing 2. Look-alike domainyourcompany-ca.com 3. "Staff" emailto the management team 4. Executive mailboxtaken over, contacts copied 5. Invoices and bankingdetails changed (BEC)
How one compromised supplier mailbox reaches your management team.
Step 1

A trusted outsider is compromised first

A contractor or supplier who emails your team every week falls for a phishing email. Their account usually has weak or no multi-factor authentication and no one watching it overnight. The attacker reads months of conversations and learns who approves payments, who sends invoices, and how your people write.

Step 2

The attacker registers a domain that looks like yours

A few dollars buys a domain one letter or one hyphen away from your real one. In a busy inbox on a phone, almost nobody notices the difference.

Step 3

Phishing arrives in a staff member's name

Using the real supplier thread and the look-alike domain, the attacker writes to your management team as if they were one of your own employees: a shared document, an urgent signature, a "quick review before the board meeting". Because the context is real, the message feels routine.

Step 4

An executive mailbox is taken over

One click and one approved sign-in prompt is enough. The attacker now controls a senior mailbox, copies the full contact list, and quietly adds rules that hide replies. From here every client, supplier and banker in that address book is a target.

Step 5

Business email compromise at the management level

Invoices are re-sent with "updated" bank details, payment instructions change, and requests to staff carry an executive's real signature. Money moves to accounts the attacker controls. Clients receive phishing from an address they trust, and the reputational damage spreads far beyond your own office.

It Happens in Minutes, Not Days

27 seconds. The 2026 CrowdStrike Global Threat Report recorded attackers moving from their first foothold to other systems in as little as 27 seconds, an average of 29 minutes in 2025, and AI-enabled attacker activity up 89% year over year.

AI lets attackers write flawless messages in your company's tone, at scale, in any language. A help desk that answers tickets during business hours cannot react in seconds. Detection and response has to be automated and watched around the clock.

What Cheap IT Support Actually Costs

You can find IT support in Vancouver from about $50 per user per month. Those plans usually stop at basic antivirus and business-hours help. They rarely include 24/7 managed detection and response (MDR) or a second, AI-driven layer of email protection, which are exactly the controls that break the chain above.

Compare that with the cost of getting it wrong. IBM's 2025 Cost of a Data Breach Report puts the average Canadian data breach at CA$6.98 million, and breaches that started with phishing averaged CA$7.91 million. Even for a small business, a single incident brings forensic work, legal advice, lost payments, notification to affected people, downtime, and higher cyber insurance premiums or deductibles at renewal.

This is not marketing. Many of the businesses that ask us to replace their IT provider do so after an incident like the one above. In almost every case the missing pieces were the same: no 24/7 detection and response, no second layer of email protection, and weak sign-in controls.

What Breaks the Chain

  • EDR with 24/7 MDR on every computer: a security team watching and responding at 2 a.m. on a Saturday, not on Monday morning.
  • AI-driven email protection as a second layer: on top of Microsoft's own filtering, to catch AI-written phishing, look-alike domains and impersonation of your own staff.
  • Phishing-resistant multi-factor authentication and alerts on new mailbox rules and unusual sign-ins.
  • Look-alike domain monitoring and blocking so mail from domains that imitate yours never reaches your team.
  • A payment-change rule: any change to bank details is confirmed by phone, using a number you already have, never one in the email.
  • Training with real examples so staff and executives recognise a convincing message that is slightly off.

Every Hexafusion plan includes EDR with 24/7 MDR and AI-driven email protection, because we will not put a client's email and computers on basic protection. If you suspect a compromise right now, read our wire transfer recovery playbook and report it to the Canadian Anti-Fraud Centre. The RCMP also explains how business email compromise works.

Do Not Choose on Price Alone

Ask any provider, including us, to show in writing whether 24/7 MDR and AI-driven email protection are included. Then compare. See what our plans include, or request a quote for your business.

Request a Quote    View our plans

Related articles: CEO Fraud and Wire Transfer Recovery · How Much Does Managed IT Cost in Vancouver? · I Clicked a Phishing Link: What to Do

← Back to Blog