INDUSTRY FACT FILE · PROFESSIONAL & BUSINESS SERVICES

Five New Case Studies in Professional Services Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in law firms, audit firms, payroll providers, staffing firms and shared-services centres and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Settlement That Went to the Wrong Account 3.  Case Study 2: The Audit Files That Appeared on a Leak Site 4.  Case Study 3: The Payroll File That Left Through a Partner 5.  Case Study 4: The Recruiter Who Was Not Hiring 6.  Case Study 5: The Help Desk That Reset the Wrong Password

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in professional and business services with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, the DPDP Act and Rules including fiduciary and processor duties, professional confidentiality under the Chartered Accountants Act and the Bharatiya Sakshya Adhiniyam, RBI's IT outsourcing directions, SEBI's frameworks and the client contracts that carry them.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Settlement That Went to the Wrong Account	Law firm	Mailbox takeover and payment diversion	CERT-In; DPDP; BCI and privilege	B3, B7, B8
2. The Audit Files That Appeared on a Leak Site	Chartered accountancy and audit firm	Data theft and ransomware through an unprotected VPN	CERT-In; CA Act confidentiality; SEBI LODR clients	B1, B7, B8
3. The Payroll File That Left Through a Partner	Payroll and HR outsourcing provider	Supply chain compromise of a file-transfer tool	DPDP processor duties; CERT-In; contracts	B9, B6, B7
4. The Recruiter Who Was Not Hiring	Recruitment and staffing firm	Candidate data exposure and fake recruiter scams	DPDP; IT Act; CERT-In	B2, B6, B7
5. The Help Desk That Reset the Wrong Password	Shared-services centre	Help-desk social engineering and payment fraud	RBI IT outsourcing; DPDP; CERT-In	B3, B10, B7

The client followed the partner's instructions exactly. The partner had never sent them.

At a glance
Organisation	A mid-size commercial law firm (“Lawco A”) handling disputes and transactions for corporate clients
Threat	An MFA-fatigue attack on a partner's mailbox, hidden forwarding rules and a lookalike-domain email changing bank details for a settlement payment
Why it is new	Cloud email puts every payment instruction one stolen session away from a fraudster
Codec Networks services	Identity and email hardening, managed SOC, BEC forensics (Bundles B3, B7, B8)

The scenario

Lawco A had moved to cloud email two years earlier with push-notification MFA. A partner, travelling and tired, approved one of a dozen prompts that arrived late at night. The attacker now had his mailbox and quietly created rules that moved any message mentioning “settlement” or “payment” to a hidden folder.

For three weeks the attacker read a live dispute settlement. On the day the client's finance team was due to pay ₹4.2 crore into the counterparty's escrow, an email arrived from a domain one letter different from Lawco A's, attaching a letter on the firm's letterhead with new bank details.

The client paid. By the time the counterparty asked where the money was, it had moved through several mule accounts. The client disputed liability, Lawco A notified its insurer and CERT-In, and partners spent weeks rebuilding the relationship and assessing which privileged emails had been read.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Push-notification MFA without number matching or phishing-resistant keys.
• No alerting on new mailbox rules or unusual sign-ins.
• No call-back verification for changed bank details.
• No lookalike-domain monitoring or client guidance on payment changes.

The impact

Lawco A faced a disputed loss, an insurance claim, a damaged client relationship and a review of which privileged communications had been exposed, and rebuilt its identity controls.

The regulatory lens

• CERT-In Directions: mailbox compromise reported within six hours of noticing it; logs needed for the investigation.
• DPDP: personal data in the compromised mailbox accessed; intimation to affected persons and the Data Protection Board once provisions commence.
• Professional duties: confidentiality and privilege of client communications under BCI rules and Section 132 of the Bharatiya Sakshya Adhiniyam.

How Codec Networks would help

Need	Codec Networks response	Bundle
Harden the mailbox	Phishing-resistant MFA, conditional access and mailbox-rule hardening	B3
Watch the signs	Managed SOC alerts on new rules, impossible travel and lookalike domains	B7
Follow the money	BEC forensics, bank recall support and evidence for police and insurers	B8

Key lessons Replace push prompts with phishing-resistant MFA. Alert on every new forwarding rule. Verify bank changes by calling a known number. Tell clients you never change bank details by email.

The ransom note arrived in results season. The files had left a fortnight earlier.

At a glance
Organisation	A chartered accountancy firm (“Auditco B”) auditing listed and unlisted companies from four offices
Threat	A stolen password on a VPN gateway without MFA, weeks of quiet data theft from audit file servers, then ransomware on the practice system
Why it is new	Extortion groups now steal before they encrypt, and audit files are worth publishing
Codec Networks services	External and remote-access testing, managed SOC, ransomware response (Bundles B1, B7, B8)

The scenario

Auditco B's VPN gateway had no MFA and had missed a security update. An article clerk's password, reused on a breached website, gave attackers a foothold, and the flat network let them reach file servers holding working papers for every client.

Over two weeks the attackers copied several hundred gigabytes, including draft financial statements of listed clients that had not yet been published. Nobody was watching outbound traffic. In the middle of the results season they encrypted the practice and document systems and left a note threatening to publish everything.

Samples appeared on a leak site three days later. Clients asked whether their unpublished results had been exposed, audit deadlines slipped, and Auditco B reported to CERT-In, engaged forensics and wrote to every affected client while restoring from backups that were only partly intact.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• VPN without MFA and an unpatched gateway.
• Flat network giving every user path to all client files.
• No monitoring of bulk data leaving the firm.
• Backups reachable from compromised administrator accounts.

The impact

Auditco B lost weeks of audit time, faced client questions about price-sensitive information, incurred response and recovery costs and rebuilt its network with segmentation and monitoring.

The regulatory lens

• CERT-In Directions: incident reported within six hours; 180-day logs needed for the investigation.
• Chartered Accountants Act and ICAI Code of Ethics: confidentiality of client information acquired in the engagement.
• SEBI LODR (clients): listed clients consider whether the incident affects their own disclosures.

How Codec Networks would help

Need	Codec Networks response	Bundle
Close the front door	External and remote-access assessment, MFA and patch assurance	B1
See the theft	EDR and 24x7 SOC with alerts on bulk data movement	B7
Recover and explain	Ransomware response, forensics on what was taken and reporting support	B8

Key lessons Put MFA on every remote path. Limit file access to the engagement team. Watch what leaves, not just what enters. Keep backups out of reach of everyday admins.

None of the forty employers had been attacked. All forty had to tell their staff.

At a glance
Organisation	A payroll and HR outsourcing provider (“Payco C”) paying staff for forty employers across India
Threat	Mass exploitation of a zero-day in an internet-facing file-transfer tool used to exchange payroll files with clients and banks
Why it is new	One provider's edge tool now holds the people data of many employers
Codec Networks services	Third-party risk, privacy and processor controls, managed SOC (Bundles B9, B6, B7)

The scenario

Payco C exchanged monthly payroll files with its clients through a commercial file-transfer tool exposed to the internet. Files included names, salaries, bank account numbers, PAN and Aadhaar-linked identifiers, and were kept on the server for a year for convenience.

A criminal group found a zero-day in the tool and exploited it across hundreds of organisations worldwide in a single weekend. At Payco C it downloaded every file on the server. Nobody noticed until the group emailed clients directly, naming them and threatening to publish their employees' data.

Employers learned of the breach from the extortion note. They demanded evidence of what had been taken, notified staff, reported to CERT-In and reviewed whether Payco C had met the safeguards and notification terms in their contracts.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Internet-facing transfer tool without exposure monitoring or rapid patching.
• Files retained for a year instead of deleted after transfer.
• No encryption of payroll files at rest.
• Contracts silent on processor safeguards and breach notification.

The impact

Payco C lost several clients, faced contractual claims and regulatory scrutiny, funded identity-protection services for affected employees and rebuilt its file-exchange process.

The regulatory lens

• DPDP: employers are data fiduciaries and Payco C a processor under contract; safeguards and breach intimation apply once provisions commence in May 2027.
• CERT-In Directions: incident reported within six hours of noticing it.
• Client contracts: security schedules, notification timelines and audit rights invoked by employers.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess the chain	Third-party risk reviews of transfer tools and SaaS vendors	B9
Hold less, protect more	Data minimisation, encryption and processor contract terms	B6
Watch the edge	Exposure monitoring and SOC alerts on unusual downloads	B7

Key lessons Delete files once they have been delivered. Encrypt payroll data at rest. Patch edge tools within days, not months. Write processor duties into every contract.

The job offers carried the firm's name. The firm had never heard of the jobs.

At a glance
Organisation	A recruitment and staffing firm (“Staffco D”) placing permanent and contract staff for large employers
Threat	A candidate database left in an open cloud storage bucket, scraped and then used for fake job offers in the firm's name
Why it is new	Candidate data is plentiful, poorly protected and perfect material for job scams
Codec Networks services	Application and cloud testing, DPDP programme, brand monitoring and SOC (Bundles B2, B6, B7)

The scenario

Staffco D's developers exported candidate records from its applicant-tracking system to a cloud storage bucket to test a new matching tool. The bucket was left publicly readable and held several years of CVs, phone numbers, salary expectations and scanned identity documents.

Scrapers found it within weeks. Soon candidates began receiving messages from “Staffco D recruiters” on messaging apps, with offer letters on lookalike letterhead from a domain the firm did not own, asking for registration and training fees and copies of identity documents.

Hundreds of candidates paid. Complaints flooded Staffco D's social media and support lines, police complaints named the firm, and two large clients asked how their own applicants' data had been handled.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Public cloud bucket with no posture monitoring.
• Years of candidate data kept with no retention limit.
• Identity documents stored unencrypted.
• No brand monitoring for fake recruiters or lookalike domains.

The impact

Staffco D faced candidate complaints, police enquiries, client reviews and reputational damage, and committed to a DPDP programme with strict retention ahead of May 2027.

The regulatory lens

• DPDP: candidate personal data exposed; safeguards, retention limits and intimation duties once provisions commence.
• IT Act: impersonation and cheating offences pursued with evidence of the fake domains and profiles.
• CERT-In Directions: data exposure reported within six hours of noticing it.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the platform	ATS, API and cloud storage testing with posture monitoring	B2
Keep less	DPDP programme with minimisation, encryption and retention	B6
Find the fakes	Brand monitoring, lookalike-domain alerts and takedown evidence	B7

Key lessons Never copy production data into test buckets. Delete old CVs and identity documents. Monitor for your brand on job sites and apps. Tell candidates you never charge fees.

The caller knew the manager's name, his team and his travel plans. He was not the manager.

At a glance
Organisation	A business support and shared-services provider (“Shareco E”) running finance operations for a private bank
Threat	A vishing call that persuaded the help desk to reset a finance manager's password and MFA, followed by changes to vendor bank details in the client's ERP
Why it is new	Attackers now target help desks because they can undo every other control
Codec Networks services	Identity and privileged access controls, social-engineering exercises, managed SOC (Bundles B3, B10, B7)

The scenario

Shareco E's help desk reset passwords and MFA for staff who called in, after checking a name and an employee number that appeared in email signatures and on professional networking profiles. A caller claiming to be a finance manager stuck at an airport asked for a reset; it took four minutes.

With the manager's access, the attacker logged into the bank client's ERP and payments queue, where the role had rights to edit vendor master data and approve batches. Over three payment runs, bank details for several vendors were changed and payments were redirected.

The vendors chased their money a fortnight later. The bank client froze Shareco E's access, invoked the audit and notification clauses in its outsourcing contract and asked for evidence of identity controls, monitoring and segregation of duties.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Weak caller verification based on public information.
• No segregation between editing vendor details and approving payments.
• No SOC alerts on MFA resets followed by sensitive changes.
• No vishing tests of the help desk.

The impact

Shareco E bore recovery costs and contract penalties, faced a client audit and the risk of losing its largest contract, and redesigned identity verification and privileged access.

The regulatory lens

• RBI IT outsourcing directions: the bank client must manage service-provider risk, including audit rights and controls over outsourced processes.
• DPDP: personal data in vendor and payment records accessed; processor obligations under the client contract.
• CERT-In Directions: incident reported within six hours of noticing it.

How Codec Networks would help

Need	Codec Networks response	Bundle
Lock the reset	Strong identity verification for resets and privileged access management	B3
Test the people	Vishing simulation for help desks and tabletop exercises with the client	B10
Join the dots	SOC alerts on resets followed by bank-detail changes	B7

Key lessons Verify callers with something an attacker cannot look up. Separate editing vendors from approving payments. Alert on resets followed by sensitive changes. Rehearse the call before an attacker makes it.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com