By Andrea Kopacek, Product Marketing Manager for CrashPlan
You might not expect a disaster recovery company to weigh in on business email compromise (BEC). But the fact that we are the ones talking about it is a sign that, too often, something’s gone wrong.
Over the past decade, BEC losses have amounted to over $50 billion. In a recent survey, Huntress reported that 36% to 51% of businesses surveyed experienced a BEC attack within the prior year.
BEC is far too common (and too successful) as an attack vector, and unfortunately, it won’t be going anywhere anytime soon. In our roles at CrashPlan, we frequently see the aftermath when an attacker gets through, so it’s clear that many organizations are fundamentally failing to understand what’s needed to prevent BEC from disrupting their business, finances, and data.
From our viewpoint, we see two major issues: one is stopping an attack in the first place. The second is recovering if an attacker gets through. These are two different jobs, and a company needs to do both well—and avoid these common pitfalls—if it wants to stay safe against most threats and resilient against the rest.
What is BEC?
Business email compromise is a form of fraud in which an attacker impersonates a trusted person or organization over email to persuade someone to send money, change payment details, buy gift cards, or share sensitive information. The email may come from a spoofed address or a genuinely compromised account.
BEC frequently works so well because it makes a fraudulent request look routine. An attacker may register a lookalike domain, copy an executive’s writing style, or pose as a trusted supplier to request an update to bank details. And worse, if the attacker has compromised an account, the message may come from a real account or even appear inside an existing conversation.
Attackers may also hijack email threads, create mailbox rules to hide replies, or use OAuth permissions to maintain access through a connected application. BEC is hard to detect because it relies on familiar tools, valid credentials, and normal business workflows.
Why are BEC attacks particularly dangerous?
BEC attacks are dangerous because they exploit users’ trust. Legitimate tools make that problem harder. Email, cloud storage, collaboration platforms, and finance systems are the trusted applications employees use every day.
A basic email filter probably won’t flag a message sent from a real, compromised mailbox. A user may see no obvious reason to doubt a message that appears in the right thread and uses the right names.
And of course, the damage often spreads beyond the original scam. An attacker may go further, deleting files, altering customer or supplier records, removing audit trails, or using one compromised identity to reach even more systems. In fact, employees may continue working with information that has been changed without their knowledge. If the organization later has to investigate or recover, it may not know which version of a record is reliable.
That creates a recovery problem, compounding any damages from the fraud itself. Microsoft Entra ID has native backup and recovery, but recovery can become difficult when a harmful change goes unnoticed for more than seven days, affects unsupported properties or relationships, or involves a hard-deleted object. In those cases, IT may need to reconstruct identity settings and related dependencies manually.
The problem is not limited to data stored in corporate systems. SANS research cited by CrashPlan found that employees also keep sensitive work data on personal devices against policy. That study was run over two years ago—and yet, there’s no sign that employee patterns are changing. These habits put important information at risk of exposure, deletion, or being left outside the organization’s recovery plan. A backup strategy that covers only the inbox or central file server may leave important business data behind.
Stop treating BEC as only a “people problem”
The pattern of compromised accounts and lost corporate data is too common for one solution to solve on its own. Too often, executives blame employees who fell victim to the scam—ignoring the systemic weaknesses that let the attack take hold.
Sure, employees have a role in preventing BEC, but scapegoating them is unfair. Attackers are not counting on people to ignore every warning; they are trying to make a harmful request appear to be a normal one. And clearly, they’re good at it.
Leaders and managed service providers (MSPs) have to consider whether employees are properly trained in BEC prevention. They also need to ensure they have the right cybersecurity protocols in place. But just as much, they need to realize they’re ultimately responsible for what happens if an attack succeeds. Can the team identify the affected accounts and records? Can it preserve evidence before mailbox rules are changed or files are altered? Can it recover endpoint and application data without depending entirely on the compromised identity? Can the business resume work using records that people know are clean?
How to get ahead of business email compromise
You need effective education, comprehensive prevention, and reliable backup, all working together.
Email protection should identify suspicious messages, lookalike domains, and impersonation attempts. Identity monitoring should surface unusual sign-ins, mailbox changes, new app permissions, and other signs that an account is being misused. Response capabilities should let the team contain a compromised account or session before the attacker reaches more systems.
And then, of course, data resilience closes a gap that those controls cannot. Continuous backups, version history, and point-in-time recovery enable the organization to restore deleted or altered files and records. They also help when BEC is followed by a broader ransomware event, destructive activity, or an investigation that requires a known-good version of the data.
Test the recovery plan; never assume it works. Teams should know which data is covered, how long it takes to restore, who can authorize a recovery, and how they will work if the original account is compromised. Recovery objectives that exist only on paper do not help during a live incident.
Employees should not have to distrust every email. They need useful training they’ll actually want to take and clear rules for verifying requests involving money, access, or business records. They need security tools they can rely on, teams that have visibility into identity and mailbox activity, and reliable support when anything goes wrong. And they also need a recovery plan. Preventing one of the most frequent cyberattacks can’t rest solely on your employees.
BEC is an identity and fraud problem, but many don’t realize it can become a data-resilience problem within minutes. Close that gap and prepare for both sides—to stop the attack, limit the damage, and quickly get back to work with the records you need.
---
As Product Marketing Manager for CrashPlan.com, Andrea Kopacek has spent over 15 years in the B2B space and specializes in IT and cybersecurity product marketing. She loves taking complex concepts and boiling them down to what matters most.
