Cyber Fraud Exposes Major Vulnerability: A Local Skincare Firm Faces a Shocking Ad Bill
The Incident That Shocked Old School Rituals
In a startling turn of events, Old School Rituals (OSR), a prominent skincare and haircare company based in Hyderabad, has become the latest victim of cyber fraud. The company recently uncovered an unauthorized Google Ads expenditure totaling an astounding ₹12.7 crores. The breach, orchestrated by an unknown cybercriminal, enabled the perpetrator to execute thousands of ads for U.S.-based companies, all from OSR’s Google Ad account over a mere 48-hour span.
Discovery of Unusual Ad Activity
The unsettling news surfaced when ENSO Business Consulting, OSR’s appointed digital marketing agency, detected an unauthorized advertising campaign that ran between May 17 and 18. The campaign generated an eye-popping 2.1 million clicks without a single conversion, raising immediate alarms. ENSO promptly alerted OSR’s management, who requested a thorough investigation into the suspicious activity.
Filing a Formal Complaint
Shashanka Kancharla, the director of OSR, wasted no time in addressing the issue, filing a complaint with the Telangana Cyber Security Bureau (TGCSB) on a subsequent Wednesday. In his formal complaint, he highlighted that the firm typically maintains a daily ad budget ranging between ₹10,000 to ₹15,000. This staggering unauthorized expenditure equates to a jaw-dropping 850 times their usual daily allocation.
“This was neither authorized by us nor aligned with our marketing strategy,” Kancharla stated emphatically in his complaint.
OSR operates from the Financial District and primarily sells its products through its official website and selected partner channels, making this incident even more critical for their business integrity.
Investigating the Breach
ENSO Business Consulting, which has managed OSR’s digital marketing for nearly a year, conducted a post-incident evaluation. Their report, submitted on May 21, suggested a possible compromise of either OSR’s Google Ads account or an employee’s credentials. Intriguingly, the firm noted a lack of notifications regarding ad placements during the two-day period when the fraud occurred.
Kancharla urged the authorities to verify if any hacking or compromise of credentials had taken place, and expressed a desire for assistance in the recovery or reversal of the fraudulent ad spend:
“Treat this as a case of cyber crime involving account hacking and significant financial loss,” he asserted in his complaint.
Taking Action Against Cybercrime
Following this alarming fraud, a Google Ads bill of ₹12.7 crores was issued against OSR, stemming from the deceptive campaigns executed by the unknown perpetrator. OSR has since informed Google Ads about the hacking incident.
In response to the complaint, TGCSB registered a case under Section 318(4) (cheating and dishonestly inducing delivery of property) and respective sections of the Information Technology Act. Investigators are actively analyzing evidence to trace the source of the security breach, having also reached out to Google for technical insights to identify the fraudster.
Conclusion: A Wake-Up Call for Businesses
The incident serves as a critical reminder of the vulnerabilities that businesses face in the digital age. As companies increasingly rely on online platforms for advertising, ensuring the security of their digital assets is paramount. This alarming case underscores the essential need for robust cybersecurity measures, vigilant monitoring, and immediate action in response to potential threats.
For more information on cybersecurity best practices, you may want to explore credible resources such as Cybersecurity & Infrastructure Security Agency (CISA) and National Cyber Security Centre (NCSC).
In an era dominated by technology, the responsibilities of businesses extend beyond the conventional; they must embrace rigorous security protocols to safeguard against the pervasive threat of cyber fraud.
