Arup
Security incident.

What the evidence shows.

The attack used fraudulent communications and video impersonation of senior staff, leading to multiple bank transfers. The case illustrates payment-diversion risk through trusted workflows rather than a software exploit.

What the number means.

HKD 200M is the transferred amount; recoveries and ultimate net loss were not established in the cited reporting. USD equivalent is approximate.

How to test resilience.

Out-of-band approval of bank-detail changes, payment dual control, executive identity verification and scenario rehearsal.