Montgomery Tank

How they got in, as reported. A supplier or vendor that was compromised first.

← All cases
Date
24 Sep 2026
Place
United States
Who
Montgomery Tank
The way in
Vendor compromise
Source
Yahoo
01 · What was reported

What was reported.

Louisiana-based business Montgomery Tank lost $40,000 to a business email compromise scam after paying a fraudulent invoice. Investigators found that the email account of a vendor the company relied on had been compromised to alter payment requests.

The way in the source reports: a supplier or vendor that was compromised first.

Investigators say the vendor's email account had been compromised before the payment was sent.Yahoo, added to these pages on 28 Sep 2026. The source
02 · The way in

What a vendor compromise is.

A vendor compromise starts at a supplier. An attacker gets into a provider first and reaches its customers through the access or the trust the provider already has.

A message from a real supplier's real mailbox asking to change bank details is the common form. Software updated by a provider the attacker controls is another.

We read a supplier's own public mail records: whether forged mail in its name would be refused and whether look-alikes of its name are registered.

A reading of public records cannot see inside the supplier's systems. A changed bank detail is confirmed by a call to a number already on file, never by a reply.

This part is true of every case of this kind. It says nothing more about Montgomery Tank than the source does.

03 · What we check for it

What we check for it.

The outside services your domain depends on.

04 · If this happens at your firm

If this happens at your firm.

  • Confirm every change of bank details on a number you already hold, even inside a real email thread.
  • Agree with your main suppliers how a change of bank details is confirmed and keep it in writing.
The attacks of 2026 and the habit that stops each →
For manufacturers and wholesalers

What we read for manufacturers and wholesalers.

  • The records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM).
  • Names made from yours, each asked whether it is registered and set up for mail.
  • Breach records for addresses at your own domain.
  • The mail records of every other domain your company owns.
  • The certificate your website answers with: its name, its dates and who issued it.
  • The headers and cookies your website sends to every visitor.

The rule, from its source: What does each US state's data breach law ask a business to do?

Check my firm

See your own firm the way an attacker reads it.

We read your domain from public records and show each way in with a check anyone can re-run.

Check my firm
05 · Source

Source.

Source: Yahoo ↗

This page repeats what the source reported, with its date. It says nothing about any firm that is not named in it.