Last updated
Arup: Cybersecurity Incident
Finance employee at Arup (London-based engineering firm) was compromised via AI-generated deepfake video call impersonating CFO and colleagues. Employee made 15 wire transfers totaling $25.6 million to Hong Kong accounts. Attackers used publicly available video/audio from earnings calls and conferences to build deepfakes.
Source: AI Insider
- Who
- Arup · UK
- What happened
- Finance employee at Arup (London-based engineering firm) was compromised via AI-generated deepfake video call impersonating CFO and colleagues. Employee made 15 wire transfers totaling $25.6 million to Hong Kong accounts. Attackers used publicly available video/audio from earnings calls and conferences to build deepfakes.
- When
- 2026-09-01
- Source
- AI Insider
- So what
- A breach is a governance event before it is a technical one.
The leadership read
A breach is a governance event before it is a technical one. For Arup in the sector, the hiring consequence is rarely more engineers; it is senior accountability: security, risk and data governance reporting high enough to change decisions. Across EMEA, watch whether the response is a hire or a contractor; that distinction says how the board has read it.
Market context: This lands while the Talent Market Index reads 97.6 (Neutral) — down 3.4 versus the prior month — and EMEA signal share is rising (+5.9pts).
Arup: 1 signal in the last 90 days; 2 tracked across 46 days.
MitchelLake in this thematic
Also at Arup →
More signals across EMEA
Cybersecurity Incident · EMEA
Goodbody →Irish stockbroker Goodbody's client portal has been down for more than two days following a cybersecurity incident. Investigations so far found no evidence that client assets were affected.
Cybersecurity Incident · EMEA
ePUAP (Polish government e-services platform) →Poland shut down the ePUAP nationwide government services platform following a cyberattack that disrupted online document submission and agency communication.
Cybersecurity Incident · EMEA
Monoprix →Monoprix was among French food retailers impacted by the October 2026 remote sabotage of refrigeration controllers, which caused fires and food spoilage. Attribution to IRGC-linked actors is disputed by Iran.
Cybersecurity Incident · EMEA
France's national blood service →France's national blood service was targeted in an attack that raised temperatures in its systems, part of a wider wave of attacks last week that also hit supermarket refrigeration across Europe.
Cybersecurity Incident · EMEA
E.Leclerc →Leclerc stores were among the French grocery chains hit by destructive attacks on refrigeration controllers in October, which caused fires and spoiled food.
Cybersecurity Incident · EMEA
Technical University of Munich (TUM) →Attackers stole central login passwords for everyone registered with TUM's myTUM portal, then used an admin's credentials to attack TUMonline, forcing the campus management system offline. Disclosed November 6; access restored November 9 with forced password resets.
Where this lands in our work
- Executive Search →
A breach puts the security, technology and risk seats under review; those searches run through our executive search practice.
- AI Executive Search →
AI capability is being built into executive stacks, not bolted on beneath them.
- Executive Search: EMEA →
Our EMEA practice runs the searches behind signals like this one.
Intelligence powered by Autonodal ↗