Hospitals AI media incident — Nov 2026
Three suspects were charged for a $129 million global fraud scheme using AI-cloned executive voices and images to deceive employees into authorizing wire.
- Reported date
- Nov 6, 2026
- Target
- hospitals, banks, and investment firms
The exact incident date was not established. This entry is dated by its source report.
Three foreign nationals have been charged in a federal indictment for orchestrating a sophisticated fraud scheme that resulted in approximately $129 million in losses across global organizations. Operating from July 2024 through February 2026, the group targeted thousands of entities, including hospitals, banks, and investment firms, by leveraging AI-generated impersonations to bypass traditional security protocols.
What happened
The attack chain relied on a multi-stage social engineering process that combined synthetic media with impersonation. The fraud typically began with a communication from an individual posing as a company’s chief executive, using AI to replicate the executive’s voice and, in some cases, their image. The impersonator would frame the request as a confidential financial transaction and direct the employee to contact a specific attorney at a major law firm for confirmation.
Members of the conspiracy then impersonated those attorneys, using scripts to maintain the ruse and instructing employees to wire large sums to accounts controlled by the group. Once the funds were transferred, the conspirators allegedly converted the money into cryptocurrency to obscure its origin. The scheme involved accounts spanning multiple countries, including the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China.
Specific victims identified in the indictment include a Missouri hospital system that lost $4.83 million, a U.K. fintech company that lost $11.58 million, and a Massachusetts mutual-fund company that lost $4.64 million. The three defendants—Jacob Soall, Sharon Hazan, and Guy Sheetrit—were arrested across Europe in 2026. They face charges including conspiracy to commit wire fraud, money laundering, and aggravated identity theft, with potential sentences of up to 20 years per count. Prosecutors emphasize that this case highlights how AI-assisted impersonation is being used to enhance conventional social engineering, making it critical for businesses to rely on independent verification rather than the perceived identity of a caller.