Hey there, this week is about trust and what happens when you can no longer take it for granted. A CFO got fooled by an AI clone of his own CEO's voice, a Kitchener man pleaded guilty to one of the biggest credential-theft schemes in years, and Europe's AI rulebook just went from theory to enforcement. Let's get into it.

🗞️ STORY OF THE WEEK

AI Voice Clones Just Talked a CFO Into a Wire Transfer

New data from cyber insurer Resilience found that human error, not sophisticated hacking, is now behind 85% of the cyber insurance losses in its claims portfolio, up from just 18% two years ago. The reason human error is winning more often isn't that people got careless. It's that AI has made social engineering far more convincing than it used to be.

The report describes a case at an unnamed financial services company. The CFO joined what looked like an ordinary Microsoft Teams call with the CEO and outside legal counsel to discuss a time-sensitive acquisition. Attackers had built AI-generated voice clones trained on publicly available audio and video of both executives, and used them to convince the CFO to authorize a wire transfer. The bank was able to claw the funds back, but the report notes a simple phone callback to a known number could have stopped the fraud before it started.

This is part of a bigger shift. Payment transfer fraud's share of insured losses roughly tripled over the past two years, from 2.9% to 9.2%, even as the total number of transfer-fraud claims fell. Attackers are moving away from high-volume, low-dollar scams toward fewer, much bigger "big game hunting" attempts, using voice cloning and AI-assisted research to target senior executives for one large payout instead of many small ones.

Why it matters to you
Any business that wires money is now a potential target, not just large banks. If someone who sounds and looks exactly like your CEO calls or video-calls asking for an urgent transfer, that likeness can now be faked convincingly and cheaply.

What can you do right now
Put a simple rule in place this week: any wire transfer or payment-detail change above a set dollar threshold requires a callback to a phone number you already have on file, never one provided in the request itself, before the money moves.

⚡THE RIPPLE EFFECT - Three stories, and what they actually mean for your business

A Kitchener Man Pleaded Guilty to One of the Biggest Data Heists in Years
A man from Kitchener, Ontario pleaded guilty this week to a hacking conspiracy that used stolen login credentials for the cloud data platform Snowflake to break into more than 165 organizations, exposing roughly 100 million records. No clever exploit was involved, just reused or stolen passwords.

What it means for you: If your business uses any cloud platform, turn on multi-factor authentication everywhere it's offered. This entire scheme ran on stolen passwords alone.

The Gang Behind an Ontario College Breach Is Now Hitting VPNs Hard
Loyalist College in Ontario confirmed personal data was accessed after the INC ransomware gang listed it on their leak site. Security researchers say the same group is now the most active exploiter of a flaw in SonicWall's remote-access VPN devices, a second front from the same crew.

What it means for you: If your business or IT provider uses SonicWall VPN devices, confirm patches are current this week. This gang is actively scanning for unpatched ones.

Europe's AI Rules Now Have Real Teeth, and More Enforcement Is Coming
The EU AI Act's high-risk obligations became legally binding on August 2, with fines of up to €35 million or 7% of global revenue for non-compliance. Days later, the EU's new AI oversight office began monthly risk monitoring of the world's most powerful AI models, a first for this kind of regulation. This follows the EU AI Omnibus we covered last edition; the rulebook keeps getting more concrete, not less.

What it means for you: If your business uses AI tools with any tie to the EU (customers, staff, vendors), this is the week those rules stopped being theoretical.

Only 3% of organizations have defined what "good enough" looks like when their AI tools start failing or acting strangely. In the same exercise, 80% of participants didn't know the minimum AI capability their tools needed before being considered safe to use again after a disruption.

✅ ONE THING TO DO THIS WEEK

Set Up a Callback Rule for Wire Transfers

This week's lead story and the Snowflake breach both come down to the same fix: verify before you trust, using a channel the attacker doesn't control. For wire transfers and payment changes specifically, that means picking a dollar threshold that makes sense for your business, then requiring a phone callback to a number you already have on file before releasing funds, no exceptions, even if the request came by video call, voicemail, or an urgent-sounding email.

This isn't a technical fix. It's a habit, and it costs nothing to put in place. Tell your finance team (or whoever pays your invoices) this week: from now on, "the CEO asked for this on a call" is not enough on its own.

If you wouldn’t wire money based on a letter alone, you shouldn’t wire it based on a voice alone. Both can be faked now.

📌 QUICK BITES

A major biotech company disclosed a cloud data breach exposing patient health information. Amgen said attackers stole patient PHI and proprietary data from its external cloud storage. If your business stores sensitive data with any third-party cloud provider, it's worth asking them directly what security attestations they can show you.

Fake Adobe and Zoom update pages are quietly installing remote-access malware. A campaign researchers are calling SMOKE#SCREEN tricks people into "updating" software through lookalike pages that instead install a legitimate remote-access tool criminals can use later. Tell your team to only ever update software through the program itself, never a link in an email or pop-up.

Microsoft fixed a record 622 security flaws this month, two of which were already being exploited. It's the largest single Patch Tuesday on record. If your business runs on Windows or Microsoft 365, this is a good week to confirm your systems are set to update automatically.

A popular AI tool for building AI agents just made a major must-patch list for the first time. US cybersecurity officials added a flaw in Langflow, a platform businesses use to build AI-powered automations, to their list of vulnerabilities being actively exploited. If your business or a vendor is experimenting with AI agents, ask whether Langflow is anywhere in that stack.

Western intelligence officials say AI is turning cyberattacks into a routine occurrence rather than a rare event. US, Canadian, and UK officials jointly warned that AI-powered attack tools are lowering the skill and cost needed to run an attack. The practical takeaway: incident response planning should now assume "when," not "if."

💬 PARTING THOUGHT

Every story this week traces back to the same idea: trust used to be something you could take for granted, a familiar voice on the phone, a login that worked, a piece of software updating itself quietly in the background. AI hasn't just made attacks more frequent. It's made the things we used to trust automatically worth double-checking.

That sounds exhausting, but the fix isn't complicated. It's the same handful of habits that have always worked: verify through a second channel, turn on multi-factor authentication, keep things patched. None of that requires a security degree. It just requires deciding, in advance, that "it sounded right" isn't proof anymore.

The businesses that come through this fine won't be the ones with the fanciest tools. They'll be the ones who built a five-second pause into their routine, and used it.

See you next Friday and stay
TryberResilient