On 15 April 2026, ANTS lost 19 million French identities through a basic technical flaw. Four days later, Vercel confirmed an intrusion that started with an employee of a third-party AI tool. Two years earlier, Arup lost $25 million to a fake CFO on a video call. AI attacks rose by 1,210% in 2025. The debate is no longer theoretical. Here is what you need to understand, with five documented cases, so as not to fall victim.
1. AI changes the very nature of attacks
Before 2023, a phishing campaign targeting a company meant writing a credible email by hand, finding a plausible pretext, and sending it to a limited list. The cost of the attack was high, the average success rate moderate, and detection still possible with classic statistical tools.
Generative AI breaks all three parameters at once. The cost of producing a contextualised phishing message falls to zero at the margin. Personalisation reaches a level that makes a once-detectable attack industrially credible. And AI-generated content defeats traditional detectors, which are based on fixed text signatures.
Analytical framework drawn from the Sumsub Identity Fraud Report 2025 and Hoxhunt Phishing Trends 2026.
The concrete consequence: a data leak that would have been exploited on a small scale before 2023 becomes, in 2026, the fuel for a targeted campaign against every person leaked, with content personalised from their exposed data.
2. Five documented cases to move beyond theory
Sources: CNN, Fortune, CFO Dive, Marketing-Interactive, The Register, French Ministry of the Interior.
Case 1 — Arup, $25 million vanished in 15 transfers
In January 2024, a finance employee at Arup's Hong Kong office receives an email from his CFO asking for a series of confidential transfers. He smells phishing. He asks for a video call to check.
On the Teams call, he sees the CFO. He sees several colleagues from the executive committee. He hears their voices. He feels reassured. He carries out 15 transfers for a total of $25 million to five bank accounts in Hong Kong (CNN, Fortune).
The trap is discovered only after the money has left. Every participant on the call — except him — was a deepfake generated from Arup's public video and audio archives (online meetings, keynotes, webinars).
It is the first known case of industrial-scale fraud by real-time video deepfake at this scale. It dates from January 2024. Two years later, the modus operandi has been industrialised.
Case 2 — WPP, the foiled deepfake of CEO Mark Read
In May 2024, attackers create a fake WhatsApp account in the name of Mark Read, CEO of the advertising agency WPP, with a public photo. They invite an "agency leader" to a Teams call. On the call: a voice cloned by AI from YouTube videos and Mark Read as an archive image (Marketing-Interactive).
Objective: to push the employee into setting up a fictitious new company to divert money and extract personal data. The employee spots the inconsistency and alerts internal security. The attack fails.
The fact that WPP — a group of 110,000 employees — was targeted with this level of social engineering shows that the technical barrier no longer applies to malicious actors. It now applies only to defenders.
Case 3 — Ferrari, the detail that saves €10 million
In July 2024, a Ferrari executive receives WhatsApp messages signed by CEO Benedetto Vigna about a confidential acquisition. A call follows. The cloned voice even reproduces the southern Italian accent of the real Vigna (Fortune).
The executive grows suspicious. He asks a question to which only the real Vigna knows the answer — the title of a book Vigna had recommended to him a few days earlier. The attacker stalls. The detail saves the operation.
Operational lesson: in 2026, no biometric signature (voice, face, accent) can be considered sufficient proof of identity in a transactional context. Only a channel outside AI validates authenticity.
Case 4 — Vercel breached via its third-party AI tool
On 19 April 2026, Vercel confirms an intrusion. The chain is instructive (The Register, TechCrunch).
- In February 2026, an employee of Context.ai (a third-party AI tool) downloads what he believes is a cheat code for Roblox. The file contains Lumma Stealer, an infostealer that siphons off his Google Workspace, Supabase, Datadog and Authkit credentials.
- Context.ai's OAuth tokens fall into the attackers' hands.
- A Vercel employee had previously authorised Context.ai with the Google Workspace "Allow All" permission (a blanket authorisation, rarely useful but often clicked out of habit).
- The attackers use this token to log in to Vercel's Google Workspace, then access vercel.com/context-inc/valinor/settings/environment-variables, where secrets, API keys and deployment configurations are stored.
- Vercel customers' environment variables are exfiltrated and put up for sale for $2 million on BreachForums.
AI is not directly in the theft. It is in the supply chain: a third-party AI tool, adopted without governance, served as a Trojan horse.
Case 5 — ANTS, 19 million French identities up for auction
On 15 April 2026, the ANTS portal (identity cards, passports, driving licences) is compromised. On 20 April, the Ministry of the Interior confirms: up to 19 million profiles exfiltrated — surnames, first names, dates of birth, addresses, telephone numbers, emails, with references to identity documents in some cases (Journal du Geek, Cryptoast).
The flaw is technical, not AI: an IDOR (Insecure Direct Object Reference) on moncompte.ants.gouv.fr. An attacker changed an identifier in the URL to access another user's data. A classic vulnerability, known for 20 years.
But the harm, for its part, is multiplied by AI. 19 million complete identities become fuel for large-scale personalised phishing campaigns, targeted voice-deepfake attempts ("Mum, it's Sophie, I've had an accident"), and AI-assisted administrative impersonation.
Notification to the CNIL, referral to the Paris prosecutor, investigation under way. For users: no mass action is possible, just individual vigilance for the next 5 years.
Case 6 — Family vishing, the 3-second fraud
Less publicised but wider: voice cloning of family members. Three seconds of audio are enough to recreate a voice. Europol intercepted more than 7,500 fraudulent calls in Europe in 2024, preventing €10 million in losses in 80% of cases (European Parliament).
The typical scheme: a parent receives a call from the "voice" of their child, in tears, saying they have had an accident or are in police custody. Immediate financial urgency, modest amount (€500-5,000), quick transfer. The parent pays before checking.
AI voice cloning progressed by 400% in 2025. One third of Europeans surveyed (France, UK, Germany, Spain) say they encountered an attempt in 2024.
3. The numbers that should worry every director
Sources: Sumsub, Right-Hand, Keepnet, The European, StrongestLayer, FBI IC3, ScamWatch HQ, McAfee Survey 2024-2026.
What matters for an SMB: not each figure taken in isolation, but the overall movement. AI-generated phishing emails have a click rate four times higher than human-written ones (StrongestLayer). 82.6% of phishing emails contain AI-generated content. BEC (Business Email Compromise) losses reach $2.77 billion in the United States in 2025 and are under-reported by a factor of 3 to 5.
Your company receives a malicious email every 19 seconds on average. The question is no longer whether you will be targeted, but when one of your employees will click.
4. What you must put in place in practice
1. Out-of-band confirmation code for any financial transaction. The Arup case ($25M) would have been avoided by a simple rule: any transfer above a threshold X requires confirmation on a different channel from the one that initiated the request. A phone call to the known number, a confirmation SMS to a verified mobile, a pre-shared question and answer like Ferrari's.
2. Audit OAuth grants and reduce scopes. The Vercel case starts with an "Allow All" clicked out of habit. Review quarterly the list of applications authorised on each employee's Google Workspace / Microsoft 365, revoke access for any non-essential app, limit scopes to the strict minimum.
3. MFA everywhere, and not only by SMS. SMS can be compromised through SIM swapping. Move to an authenticator app (Microsoft, Google, Authy) or a physical key (Yubikey) for sensitive accounts. OAuth token theft remains possible, but adding MFA on access reduces the window of exploitation.
4. Governance of third-party AI tools. Ban the use of unvalidated AI tools (Shadow AI), maintain a whitelist of authorised applications, review their Google Workspace / M365 permissions. The Vercel case is typical: a well-meaning employee adopted a useful tool without security validation.
5. Deepfake training for at-risk roles. Management, accounting, purchasing, HR, legal. Not a generic annual training: short monthly sessions, with recent concrete cases (Arup, Ferrari, WPP), simulation exercises. The "I call back before acting" reflex must become automatic.
6. Monitoring of exposed data. Watch for your company's data on leak forums (BreachForums, Have I Been Pwned, DeHashed, Intel 471). For key people (executives, finance managers), set up personal monitoring. The ANTS or OPQAST leaks will fuel targeted attacks for at least 5 years.
5. For SMBs without a dedicated IT department
The particular difficulty for SMBs: having no in-house security team. Which does not mean "doing nothing". Three minimum actions:
- A one-off annual audit with a cybersecurity provider specialising in SMBs (budget €3-8k). The aim is not to reach government level, but to close the gaping holes that every automated attacker exploits.
- An outsourced monitoring contract (MSSP) on critical access. Budget €300-1,000/month depending on size, for 24/7 monitoring that detects an abnormal login before it deploys its payload.
- Cyber insurance with a deepfake and BEC clause. 2026 contracts are starting to include these scenarios; older contracts often exclude them. Check the exclusions before an incident.
Conclusion
The answer to the question in the title is yes, unambiguously. AI amplifies cyber risks on three simultaneous dimensions: sophistication (credible content on every channel), personalisation (each target receives an attack designed for them), and scale (what cost €10,000 to produce in 2022 costs 10 cents in 2026).
The bad news: no technical solution will make up for this asymmetry. Detection tools are always one step behind attack tools. The good news: human reflexes remain effective. Every foiled case of 2024-2026 (Ferrari, WPP) was foiled by a person who knew how to say "I'll call back first". Every successful case (Arup, Vercel) succeeded because a chain of trust was built blindly.
In 2026, cybersecurity is no longer an IT subject. It is a matter of culture and procedure. Training your teams, hardening your workflows, monitoring your third-party tools: these are the three levers that decide whether your SMB is among the companies that resist or among those that will, unwillingly, fund the next developments in offensive AI.