Desk live·
ForensicPost
Cloud/Accountability/File 25-1010b

A Redirected Salary Leaves Unsettled Who Carries the Loss

A redirected salary raises a question the corpus has not previously had to ask: whether the employer has paid, and who carries the loss while that is decided.

Constructed geometry · not a chart of case data
TargetAffected employees
ActorUnattributed
S. Rosler11 min readConfidence: low1 source reviewed

When payroll is redirected as at 25-1009b, an employer has transferred funds and an employee has not been paid. This file examines who bears that gap.

The Corpus Has No Comparable Question

Almost every file here concerns data leaving an organisation. Loss allocation, where it arises at all, is a matter of settlements paying single-digit dollars, per 25-1227.

Redirected wages are different in kind. Money moved, a specific person is short a specific amount on a specific date, and somebody has to be out of pocket while it is resolved.

The Employment Position Is Probably The Stronger One

An employer owes wages. Paying the wrong account arguably does not discharge that obligation, which would leave the employer to reissue and pursue recovery itself.

That reading places the loss on the party with the balance sheet to absorb it and the control over the system that was abused — which is the outcome the corpus would consider correct, and it is a legal question this desk is not competent to resolve, and which varies by jurisdiction.

What Happens In Practice Is The Part That Matters

The corpus recorded at 25-0530 that Coinbase reimbursed a quantified loss, and at 25-1227 that money reaches people only where loss is quantifiable. A redirected salary is maximally quantifiable — an amount, a date, a destination.

By that rule it should be reimbursed, and quickly. Whether it is, and how long an affected employee waits, is not established in anything this desk reviewed.

Graded Low

This file asks a question rather than answering one. No source we reviewed addresses loss allocation, no jurisdiction is analysed, and no affected employee’s experience is recorded.

It is filed because the corpus’s central complaint — that harm to individuals is unquantifiable and therefore uncompensated — has an exception here, and the exception is worth marking even before it can be resolved.

This is an analysis file

It raises a loss-allocation question arising from 25-1009b. It is not legal advice and reaches no conclusion. Corrections: corrections@forensicpost.com.

Sources
  1. Investigating targeted payroll pirate attacks affecting US universitiesMicrosoft Security
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary