Capillary Technologies has announced the completion of a forensic audit by KPMG concerning a cyber-enabled banking fraud incident at a step-down subsidiary. The report, received on October 30, 2026, found the incident to be a fraud perpetrated by external parties through impersonation and off-channel communications. Crucially, the investigation found no evidence of internal employee involvement, traditional email spoofing, malware, or unauthorized access to the company’s systems. Capillary has also strengthened its payment controls and is pursuing recovery and legal remedies.
Forensic Audit Concluded on Cyber Fraud Incident
Capillary Technologies has provided an update regarding the forensic audit initiated on July 31, 2026, concerning a cyber-enabled banking fraud incident. The company received the final report from KPMG Česká republika, s.r.o. on October 30, 2026. The investigation aimed to understand the root causes and impact of the incident on a step-down subsidiary.
Key Findings of the Forensic Report
The forensic report indicates that the incident was a fraud executed by external parties who impersonated a senior executive and an external lawyer. The fraud was facilitated through the use of a look-alike email domain and off-channel communications. Significantly, the investigation did not find any evidence of:
- Traditional email spoofing.
- Forged use of the Company’s real domain.
- Malware or endpoint compromise.
- Mailbox or account compromise.
- Unauthorized access to the Company’s systems, devices, or email accounts.
Furthermore, the report found no questioned employee involvement or wrongdoing. The investigation also confirmed the absence of any technical compromise related to the incident. The company has since strengthened its payment controls and is actively engaged in pursuing recovery and legal remedies.
Management’s Assessment and Next Steps
The management of Capillary Technologies views the incident as a payment-diversion fraud, primarily driven by social engineering tactics and impersonation. While the use of deepfake technology was alleged, it could neither be substantiated nor refuted due to the unavailability of original audio, video, and telecommunications evidence. The company has emphasized that the findings do not point to a technical compromise of corporate endpoints or accounts. Capillary Technologies is committed to enhancing its security protocols and vigilance in light of this event. This announcement will be made available on the company’s website.
Source: BSE
