High-profile enterprise phishing incidents serve as stark reminders of how even the most secure organizations can fall victim to sophisticated attacks. These incidents often involve large corporations, government entities, or financial institutions, where attackers target valuable data, intellectual property, or large sums of money. Here are some notable examples of enterprise phishing incidents:

• Google and Facebook (2013-2015): In one of the largest phishing attacks targeting major tech companies, attackers posed as a hardware supplier and tricked Google and Facebook into transferring over $100 million. The phisher sent fake invoices and payment requests, convincing employees to wire funds to fraudulent accounts over several years before being caught.
• Ubiquiti Networks (2015): Ubiquiti Networks, a networking technology company, lost $46.7 million in a phishing attack where employees were tricked into transferring large sums to overseas accounts. The attackers used business email compromise (BEC) tactics, impersonating high-level executives and suppliers to authorize the payments.
• Anthem (2015): Health insurance giant Anthem fell victim to a phishing attack that compromised the personal information of nearly 80 million people. Attackers sent phishing emails to employees, eventually gaining access to databases containing Social Security numbers, addresses, and other sensitive personal data, resulting in one of the largest healthcare data breaches in history.
• Sony Pictures (2014): The infamous Sony Pictures hack began with a phishing email that tricked an employee into revealing credentials, allowing attackers to gain access to the company’s internal network. The breach led to the release of confidential emails, unreleased films, and sensitive employee data, costing Sony an estimated $15 million in damages.
• Crelan Bank (2016): Belgian bank Crelan was defrauded of approximately $75 million through a BEC attack. Phishers posed as executives, sending fraudulent emails requesting large wire transfers to accounts controlled by the attackers. The incident highlighted the vulnerabilities in email communication between employees and corporate leadership.
• The World Anti-Doping Agency (WADA) (2016): WADA was targeted by a phishing attack that led to the leak of sensitive medical records of high-profile athletes. Attackers used spear-phishing techniques to gain access to the organization’s systems, revealing personal medical information and sparking a major scandal in the sports world.
• Sequoia Capital (2021): Sequoia Capital, a prominent venture capital firm, suffered a phishing attack that compromised sensitive financial information. Attackers gained access to internal emails and documents, highlighting how even companies in industries outside of traditional targets like finance or healthcare can be affected by phishing.
• Twitter (2020): In a coordinated phishing attack, hackers compromised the accounts of high-profile individuals, including celebrities and politicians, on Twitter. The attackers targeted Twitter employees with spear-phishing tactics, gaining access to internal tools used to reset account passwords. The breach resulted in the takeover of numerous verified accounts, which were used to promote a cryptocurrency scam.
• Colonial Pipeline (2021): Although primarily known as a ransomware attack, Colonial Pipeline’s breach was initiated through phishing. Attackers used phishing emails to gain initial access to the company’s network, which led to a ransomware attack that shut down the pipeline's operations, disrupting fuel supply across the U.S. East Coast.
• The Democratic National Committee (DNC) (2016): In one of the most politically significant phishing incidents, hackers gained access to the DNC’s email system through a spear-phishing attack, leading to the leak of confidential emails during the U.S. presidential election. This attack highlighted the geopolitical implications of phishing and its potential to impact national security.

These incidents emphasize the significant financial, reputational, and operational risks that phishing poses to enterprises. Despite robust cybersecurity measures, attackers continue to evolve their tactics, making it essential for organizations to prioritize phishing awareness, employee training, and incident response plans.