Capillary subsidiary hit by €3M deepfake-enabled banking fraud

What to watch

• KPMG findings on whether fraud arose from a human-authorisation lapse, compromised credentials, bank-account manipulation or broader control failures.
• Any revision to the gross loss, recovered amount, insurance coverage or expected net financial impact.
• Confirmation of whether other subsidiaries, vendors, bank accounts or payment workflows were targeted.
• Customer renewal, deal-cycle or procurement-security commentary following the incident.
• Regulatory, law-enforcement, litigation or insurer developments.
• Management changes, delayed acquisition integration or new treasury-control investment.
• Complete the KPMG forensic audit and disclose whether the incident was isolated, including the control failure and remediation timeline.
• Implement out-of-band callback verification, dual approvals, payment hold periods and bank-account change controls for all subsidiaries.
• Centralize treasury visibility and fraud monitoring across acquired entities; run deepfake and business-email-compromise simulations for finance leadership.
• Pursue additional fund recovery through banks, law enforcement, insurers and relevant payment intermediaries.
• Provide enterprise customers and prospective buyers with a clear assurance package confirming the scope of impact, data-security status and strengthened controls.