A local real estate company had an email account compromised, because multi-factor login was never turned on.
The attacker watched quietly, then sent look-alike invoices using changed banking information. The emails came from a real address, in the middle of real projects, about real money owed.
Vendors nearly paid the wrong account. It was caught, barely, by someone who picked up the phone to confirm.
This was not advanced cyber warfare. It was a missing setting, an unguarded inbox, and a payment process that trusted an email.
