Chijioke Timothy Odimegwu and Harafat Mogaji received a combined 189 months for a scheme that ran nearly two years.

 

What happened

Two former United States Air Force members were sentenced on September 25, 2026, for running a business email compromise operation against at least 15 organizations, The Record reported. Chijioke Timothy Odimegwu, 25, received 111 months in prison and was ordered to pay $366,617.59 in restitution. Harafat Mogaji, 26, received 78 months and was ordered to pay $995,680.45. Both were on active duty and stationed at Dover Air Force Base in Delaware when they carried out the attacks, and both will serve three years of supervised release. They pleaded guilty to wire fraud, identity theft, and access device fraud.

 

Going deeper

The scheme began with phishing emails sent to businesses to collect usernames and passwords for employee email accounts. What followed is the part that made it work. Having reached inside real mailboxes, the pair monitored conversations until a payment came up between the organization and one of its business partners, then joined that existing thread and sent what appeared to be updated wiring instructions. The recipient saw a message continuing a conversation they had been part of for days or weeks, referencing an invoice and a relationship that were entirely genuine. Spoofed addresses mimicking the partner's domain were used alongside the stolen credentials. Payments went to accounts held by accomplices in the United States and abroad, and the pair also made unauthorized transactions using stolen account numbers, personal identification numbers, and card details, according to BleepingComputer.

 

What was said

The pair "attacked business victims across the United States with email spamming and phishing campaigns" for nearly two years, prosecutors said in the announcement of the sentences. The case was investigated by the FBI with assistance from the Air Force Office of Special Investigations, and prosecuted in the Southern District of Iowa.

 

In the know

Victims ranged from private companies to a municipal government. A company in Iowa City lost a wire transfer of more than $1.68 million, and the city of Athens, Ohio, sent more than $720,000, according to KCRG, which reported that a nonprofit in Pella, Iowa, also had credit card information stolen and used for unauthorized purchases. Business email compromise generated 24,768 complaints and more than $3 billion in reported losses during 2025, ranking among the most financially damaging categories tracked in the FBI Internet Crime Complaint Center's annual report and those figures count only what victims reported.

 

The big picture

Healthcare organizations pay equipment suppliers, billing vendors, contractors, and staffing agencies against emailed invoices, the same payment workflow this scheme went after. Once a diverted wire goes out, the FBI’s Recovery Asset Team can work with banks to freeze it through a process the bureau calls the Financial Fraud Kill Chain. The team took on 3,900 incidents in 2025, covering $1.16 billion in attempted theft. It froze $679 million of that, a 58% success rate, according to the FBI Internet Crime Complaint Center’s 2025 annual report. The freeze only works while the money is still sitting in the receiving account, so the clock starts when finance staff notice the payment went to the wrong place. A hijacked thread at a covered entity carries a second obligation too. The compromised mailbox may hold protected health information, which starts a risk assessment under the Breach Notification Rule whether or not any payment was diverted.

 

FAQs

What makes thread hijacking harder to spot than a spoofed email?

The message continues a conversation the recipient already trusts, with genuine history above it. Nothing about the context is invented, so advice built around checking whether a sender is familiar or a request is expected produces the wrong answer.

 

How do attackers know when to intervene?

By reading the mailbox. Once inside an account, they monitor for invoices, payment approvals, and discussions of transfers, then time their message to arrive when a payment is already expected.

What should finance teams do when banking details change?

Verify by calling a number obtained independently from a contract or an existing record, confirm with a person the organization has spoken to before, require a second approver for the change, and document the verification in the payment record.

 

Does a mailbox compromise at a healthcare organization require notification?

It requires a risk assessment. If the mailbox held protected health information, the covered entity assesses what was accessible and whether it was acquired, and audit logging configuration determines how confidently that question can be answered.