Insuring Your Finance Executives Can Make Them Personally Liable for a Fraud Loss

Confidence: MODERATE · Germany · Financial Services, Insurance

A finance executive sent 59 wires in 25 days to fraudsters posing as his boss. A German appeals court says he owes his employer for the loss, and the reason it gave is the insurance policy the employer bought to protect him.

In July and August 2024, the head of global treasury, the executive who manages the company's cash, at a German carbon-black manufacturer made 59 transfers totaling more than €50 million to fraudsters. They had spoofed his supervisor's number from the company directory, told him he would run a new subsidiary in Asia, and moved the instructions to a messaging app on his private phone. He never checked with his supervisor, and he skipped the company's rules on payment approval and private messengers. The court did not name the company.

On July 31st the Cologne state labor appeals court upheld his dismissal and ordered him to repay the transfers, minus what the company has recovered. It found gross negligence: he had watched a training video on CEO fraud, and a financial manager at his level should have confirmed the instructions with his supervisor in person.

German employment law normally shields an employee from the full cost of a workplace mistake. Courts scale the loss to fault, nothing for slight negligence, a share for ordinary negligence, and the full loss for gross negligence. Even then they can reduce it if the amount would ruin the employee, and the court accepted that this sum was far beyond what he could pay. It refused to reduce it anyway. His employer pays for a directors-and-officers liability policy, the insurance companies buy against claims made personally against their managers, and the policy names him as insured, with up to $150 million of insurance coverage. The court's reasoning is that the protection exists to keep an employee from financial ruin, and this policy already covers that risk. The company can collect from him, and he can look to the insurer.

Whether the insurers will pay is disputed. His employer says they approved coverage while the case was under way; he says they made no commitment and are still examining the claim. The court put the burden on him to show the policy will not pay, and said that waiting on the insurers' answer does not meet it. It allowed an appeal to Germany's Federal Labor Court, and one is pending.

The Takeaway: This is German law, and no US court is bound by it. The open question is whether the same logic reaches here: the company pays for a policy that names a finance executive, then holds that policy against him. If the insurer refuses to pay, the judgment against him may still stand.

Sources: LAG Köln judgment, 8 SLa 603/25, July 31st, 2026 (German) · Gleiss Lutz: Cologne Higher Labour Court on D&O insurance and limited employee liability · Stein & Sonntag: senior employee liable for damages in the millions (German) · heise: CEO fraud, manager liable for multi-million loss (German)

The Firm You Hire to End a Ransomware Attack May Be Working the Other Side

Confidence: MODERATE · United States, Canada · Professional Services, Technology

A Florida firm that promised to unlock ransomware victims' files allegedly bought the key from the attackers for about $8,200 and billed a client about $150,000. It is one of three recent cases involving ransomware-response firms or their people: one has been sentenced, two are accused.

Zohar Pinhasi, 50, owns MonsterCloud LLC, a Florida company that sold itself as a ransomware remediation service. A federal grand jury in Brooklyn indicted him on September 23rd, and he was arraigned on October 7th on wire-fraud charges carrying up to 20 years. Prosecutors allege MonsterCloud told victims it could unlock their files with its own tools, so they would not have to pay criminals, when it had no such tools. Instead, they say, it contacted the attackers in secret, bought the decryption key and billed the client far more than it paid: over $19 million charged to clients against over $8 million in ransoms. In one August 2023 case, the Justice Department says, it paid about $8,200 and billed about $150,000. A 2019 message quoted by prosecutors reads: "Monstercloud doesn't hold any Proprietary technology [to] decrypt the ransomware data." The US Attorney said Pinhasi "re-victimized his clients while extracting a hefty profit for himself." He is presumed innocent.

Edward Dubrovsky, 54, a Canadian executive in ransomware negotiation, was arrested on Thursday, October 8th, in Pennsylvania, where he was attending a cyber risk conference. The court docket charges him with conspiracy to extort money by threatening to compromise the confidentiality of information, and with extortion by threats affecting commerce. The complaint is sealed, so what he is accused of doing is not public, and the FBI has not said how he fits. The next day FBI Director Kash Patel announced the arrest of "another suspected co-conspirator" of ShinyHunters, the extortion group the FBI believes breached its job-applicant portal, without naming anyone. The New York Times reported the suspect was a Canadian arrested in Pennsylvania, and Krebs on Security's sources tie Dubrovsky to the investigation. Krebs's sources also say charges against principals at other negotiation firms may follow. Cypfer, the Canadian negotiation firm he worked for, says he resigned as a managing director in November 2025.

This is not the first such case. In July, Angelo Martino, a negotiator at the ransomware-payment firm DigitalMint, was sentenced to 70 months for running attacks as an affiliate of the BlackCat ransomware gang, extracting about $75 million, including from five companies that had hired his own firm. DigitalMint is not accused of knowing.

Two of these cases are about a response vendor working against its own clients, one proven and one alleged. The third is an arrest tied to an extortion investigation, and nothing public says whether his clients were involved. Paying a ransom through a third party is not itself illegal for most victims.

The Takeaway: The surest protection against a dishonest response firm is not needing one. Strong cyber defense, backups you can restore and limits on what an intruder can reach keep you out of a market where secret payments change hands and the people in it come from trusted places. If you do keep a firm on retainer, it may be worth getting four answers in writing before you need it: will it pay attackers on your behalf, whose money does it use, what does it charge on top, and does it check who it is paying against sanctions lists.

Sources: DOJ, Eastern District of New York: owner of Florida ransomware remediation company charged with defrauding clients · The Record: DOJ charges ransomware recovery firm owner · Krebs on Security: FBI Arrests Executive at Ransomware Negotiation Firm · CyberScoop: Edward Dubrovsky, Cypfer, arrested on extortion charges · BleepingComputer: Cyber exec arrested in case allegedly tied to ShinyHunters hackers · Hackread: FBI arrests ransomware negotiation firm co-founder in ShinyHunters probe · DOJ: Florida ransomware negotiator who extorted and attacked multiple US victims sentenced to prison · CyberScoop: DigitalMint negotiator Angelo Martino extortion case

American Express's Bank Will Pay $350 Million After $13 Billion in Suspected Laundering Moved Through It

Confidence: HIGH · United States · Financial Services

The OCC says the bank's controls were built for its small deposit business while about $13 billion in suspected laundering moved through the bank. Nothing in the orders restricts customers or mentions corporate cards.

The Office of the Comptroller of the Currency, the regulator that supervises national banks, fined American Express National Bank $350 million on October 8th and ordered it to rebuild its anti-money-laundering program. The Federal Reserve issued a separate cease-and-desist order against the parent, American Express Company, and American Express Travel Related Services Company. The bank neither admits nor denies the findings.

The regulator says American Express's bank pointed its anti-money-laundering controls at the wrong business. They were built around its small deposit-account business, and its much larger credit and charge card business got too little attention. From June 2014 to May 2025, about $13 billion in suspected money laundering passed through the bank. The order calls it trade-based laundering, which means moving money across borders by faking the paperwork on goods that were bought and sold. Some of it ran through card charges and the payments that paid them off, and some through accounts tied to bank insiders. The bank did report suspicious activity now and then, but it did not have the controls to catch and report all of it. The orders do not say what the charges were, how many accounts were involved or who the insiders were.

Neither order restricts new customers, products or accounts or mentions commercial or corporate cards. They do require stricter due diligence for higher-risk customers, risk-based transaction limits on the bank's products, controls on ACH, the bank-to-bank electronic payment system, and a look-back at past accounts and suspicious-activity reports filed with the Treasury. A board compliance committee is due in 15 days and an action plan in 90. The Federal Reserve's order also bars the company from rehiring anyone it disciplined and let go over the misconduct, and does not say how many people that covers.

For cardholders, the orders point to little more than extra questions. The new limits apply to the bank's own products, and American Express does not say which of its companies issues corporate cards, so some business cardholders may notice nothing at all. The first earnings call since the orders is October 23rd.

The Takeaway: Most companies will feel nothing from this. If you carry American Express business cards, the most the orders point to is more questions about your company and tighter limits on some transactions. The wider lesson is the OCC's: controls built for the business you started with do not stretch to the one you became.

Sources: OCC news release 2026-87: action against American Express National Bank · OCC consent order AA-ENF-2026-46 (PDF) · Federal Reserve Board: enforcement action against American Express Company · American Express Form 8-K, October 8th, 2026 · Federal Reserve order to cease and desist, Docket 26-052-B-HC (PDF) · American Express 10-Q for the quarter ended June 30th, 2026 · American Express 10-K for 2025 · American Express Corporate Card Member agreement (PDF)

From Tuesday, One Banned Chip Can Keep a Whole Device Off the US Market

Confidence: HIGH · United States, China · Technology, Telecommunications, Manufacturing

The FCC will no longer approve new devices that contain chips from companies it considers national-security risks, such as Huawei and ZTE. It matters if you sell hardware that someone else builds for you.

Starting October 13th, the Federal Communications Commission will not approve a new electronic device if it contains a chip or module made by a company on its Covered List. The list names makers the FCC considers a national-security risk, including Huawei and ZTE. Surveillance-camera and radio makers such as Hikvision are listed for certain uses.

The FCC's worry is hidden code or backdoors in the chip. In its words, a compromised component can enable sabotage or unauthorized access "regardless of their visibility to end users or the branding of the final product." The buyer cannot see inside the chip.

Only a few makers are named, and nothing already approved changes. It can still be sold, imported and used. What changes is new products and new versions: if a contract manufacturer swaps in a part from a listed maker, the changed device cannot be approved. That is the exposure for a company that sells hardware under its own brand and has someone else build it. If you only buy equipment, the effect is on what you can buy later, not on what you already own.

The Takeaway: If you sell hardware that someone else builds, it may be worth knowing who approves a part substitution and whether anyone checks the FCC's list.

Sources: FCC Third Report and Order, FCC-26-50, logic-bearing components from Covered List entities (PDF) · Federal Register: final rule, effective October 13th, 2026

The Justice Department Wants Stolen Fraud Money Frozen Before It Disappears

Confidence: HIGH · United States · Financial Services, Technology

A Justice Department memo signed October 7th tells fraud prosecutors to freeze money soon after it is stolen, in some cases before anyone is charged. The aim is to get money back to victims before fraudsters spend or hide it.

Colin McDonald, the Assistant Attorney General who heads the Justice Department's new National Fraud Enforcement Division, starts from a problem: criminals "often spend or hide criminal proceeds before investigators and prosecutors can identify assets, bring charges, and recover the stolen funds," and once caught, fraudsters are "usually unable to pay back their victims." His prosecutors "will therefore prioritize early seizure of fraud proceeds and early disruption of fraud schemes." The memo covers fraud against health-care and government programs, tax and trade fraud, securities and consumer fraud, and cybercrime.

The tools it lists include freezing money at banks and cryptocurrency exchanges "shortly after they have been stolen," seizing websites, domains and online accounts, and going after property in court "before initiating criminal charges." Only that last one is explicitly pre-charge. The stated goal is to "maximize recovery for victims" and have fraudulent proceeds "returned to their rightful owners." The memo does not promise any particular victim a recovery.

It also says the division will "identify and hold accountable all persons and entities that knowingly enable, facilitate, conceal, or profit from" such schemes. Banks and exchanges appear only as the places where money gets frozen; the memo says nothing about their liability or about notifying them first.

The Takeaway: If your company is hit by fraud, speed is the lever. The memo is built around freezing money soon after it is stolen, so reporting fast to your bank and to law enforcement may improve your odds of getting it back. If your business moves or holds other people's money, or runs their websites and systems, expect more freeze and takedown requests from law enforcement, and be ready to act on them quickly. The memo says the division will hold accountable anyone who knowingly enables or profits from fraud, and a slow response could draw questions about you.

Sources: DOJ Directive 26-13, "A Comprehensive Approach in the Fight Against Fraud" (PDF) · DOJ press page: Assistant Attorney General McDonald issues memorandum on national fraud enforcement

Saudi Arabia Wants the Hormuz Bypass Written Into Its 2027 Supply Contracts

Confidence: MODERATE · Saudi Arabia, Middle East · Energy, Maritime, Logistics

Saudi Arabia is discussing making its workaround for the disrupted Strait of Hormuz a standing part of its 2027 oil contracts. A major exporter planning that far ahead is betting the disruption lasts.

Saudi Arabia is talking with customers about writing the workaround it has used during the Iran war into long-term contracts, with loadings outside the Strait of Hormuz starting next year, Bloomberg reported on October 8th. The workaround already runs: Aramco, the Saudi state oil company, lets some buyers take cargo by ship-to-ship transfer off India. The talks must conclude by year-end and are not final; pricing, freight and volumes are still under discussion. Bloomberg, citing people familiar with the talks, is the only outlet reporting this. Aramco and the Energy Ministry did not respond to requests for comment.

Traffic through the strait is a fraction of normal. IMF PortWatch, which counts ships from tracking data, recorded 4 transits on October 4th, the latest day in its series, against an average of about 85 a day through 2025. Passage is also costly: Fortune reports that war-risk insurance can command 6% to 10% of a ship's value, up to $20 million for a supertanker, and Lloyd's List reported that before the war the extra premium for Gulf trips was 0.15% to 0.25%.

The Takeaway: Most companies never ship through the strait, but they pay for what moves through it. If one of the world's largest oil exporters is planning for the disruption to last, energy prices may keep swinging well into 2027, and fuel and freight budgets built on a quick return to normal may come up short.

Sources: gCaptain: Saudis in talks to formalize Hormuz shuttles in fight for market share · Fortune: ship captains, crews and the cost of running the Strait of Hormuz · Bloomberg: Saudis in Talks to Formalize Hormuz Shuttles in Fight for Market (October 8th, paywalled) · IMF PortWatch: Strait of Hormuz daily transit data · Lloyd's List: Gulf war risk premiums topping double-digit millions of dollars per trip (March 11th)

Eight Employers, Microsoft Among Them, Were Suspended From Green-Card Sponsorship With No End Date

Confidence: MODERATE · United States, India · Technology, Professional Services

If your company sponsors foreign workers for green cards, the Labor Department has shown it can stop an employer's processing while investigations are still open.

On October 8th, Vice President Vance and Labor Secretary Keith Sonderling announced that the Labor Department has suspended eight employers from permanent labor certification, the first step in an employer-sponsored green card. They are Microsoft, Adobe, Cognizant, Infosys, Tata Consultancy Services, Wipro, HCL Technologies and Capgemini. The department will not accept new applications from them or process pending ones. No end date has been set, and the administration cites alleged visa abuse and "multiple active federal investigations." The suspension does not touch their workers' H-1B status, the temporary skilled-worker visa most of them hold, or their authorization to work. One immigration law firm reads the rule as allowing a pause of up to 180 days, as in software company Cloudera's May suspension, and then longer. The department had posted no written notice as of Sunday; the details come from the press conference as reported by Reuters, CNBC and the Associated Press, and from immigration law firms.

The Takeaway: If your company sponsors employees for green cards, the exposure is direct: an employer can be stopped while investigations are still open, and a worker partway through the process usually has to start over with a new sponsor. If you sponsor no one, you will most likely feel this only as turnover at an IT vendor. Nobody can say yet whether the pause becomes a ban.

Sources: Reuters: Trump administration freezes green cards for Microsoft, IT firms, probes universities (October 8th) · Associated Press via PBS NewsHour: Vance says Microsoft is being suspended from the green-card program · Fox Business: Vance suspends Microsoft and others from green-card sponsorship · Ellis: PERM suspension of Microsoft, Adobe and six IT firms, what it means · CNBC: Microsoft, Adobe hit with green-card labor suspension

Got this forwarded to you? Subscribe at stateofthethreat.com/subscribe — one email per week, no tracking, no spam.

Want headlines as they break, not just once a week? Check the daily brief box at stateofthethreat.com/subscribe.

Know someone who needs this? Forward this email. The threats they don't know about are the ones that hurt.