Short answer
A hacked consultant can send you phishing emails from their real, trusted address. Attackers use that inbox to share fake drawings, signature requests and invoices with everyone on the project team. That is why a familiar sender no longer proves a message is safe. Any changed payment detail should be confirmed by phone, even from a long-time sub. Contracts and insurance can also affect who bears the cost, and wording varies, so review the actual terms.
Why a hacked consultant puts your firm at risk
Design projects run on a web of consultants. Architects, MEP engineers, structural engineers and civil engineers email each other all day, and most messages are routine. Attackers know that a message from a trusted partner gets far less scrutiny than one from a stranger.
Security vendors have described this pattern. Darktrace described a fake file-share notice sent from a compromised supplier account, and Trustifi described a similar technique using trusted platforms. In these cases, the sender’s address was real. The account behind it was not under the consultant’s control.
What the 2026 breach report says about third parties
Verizon’s 2026 Data Breach Investigations Report reportedly found third parties involved in a large share of the breaches it studied. Secondary coverage describes the figure as close to half, but those write-ups are not consistent. Please check the number against the original Verizon report before publishing, and quote it only after confirming.
The data spans many industries, so it does not predict what will happen at any one firm. It does support a simple point. A firm’s exposure includes the security habits of the people it works with.
Why a familiar sender proves very little
Most people judge an email by who sent it. A hacked consultant’s account breaks that habit. The message can reference a real project, arrive at a believable time and come from an address the firm has used for years.
That makes the content of the request more important than the sender. Be careful with unexpected sign-in links, drawings that require a new login and any request involving money. The phishing and IT security checklist covers the habits that help.
Which rules help when a consultant is compromised
A few practical rules reduce the risk:
- Confirm any changed payment details by phone, using a number you already have. Do this even for long-time subconsultants.
- Treat unexpected sign-in requests as suspicious, even from known contacts.
- Tell the consultant right away if something looks off. They may not know their account was compromised.
- Keep a written payment verification process that applies to every vendor, not just new ones.
Real-world example
Consider a hypothetical prime architecture firm working with a structural subconsultant on a mid-size project. The sub’s email account was compromised the week before. The firm’s project manager receives a message from the sub’s real address saying their bank details have changed and the next invoice should go to a new account.
The firm’s rule applies to every vendor, so she calls the structural engineer on the number in the signed subconsultant agreement. He had sent nothing and had not noticed a problem. His firm then takes steps to secure the account.
The email looked right. The phone call caught it.
Contract questions to review with subconsultants
Contracts can address cyber risk in ways many firms have not checked. Firms may want to look at:
- Whether subconsultant agreements require any cybersecurity measures or insurance, and how those requirements are worded.
- Whether client contracts now require the firm itself to carry cyber coverage.
- Whether obligations in the prime agreement pass down to subconsultants through a flow-down provision.
Terms differ from project to project, and requirements should fit the specific engagement. A contract check can help identify the clauses worth a closer look before signing.
What dependent business interruption means for design firms
A firm can lose income when a vendor it depends on goes down, even if the firm’s own systems are fine. That could be a hosted software platform, a file-sharing service or another outside provider. Some cyber policies address this through dependent business interruption coverage.
Whether a policy includes it, and how it is defined, varies. The comparing cyber quotes page shows where to find the dependent business interruption line.
What to check in your firm
Firms may want to review:
- Whether the firm confirms changed payment details by phone for every vendor.
- Whether staff know to question unexpected sign-in links, even from known consultants.
- What subconsultant agreements say about cybersecurity and insurance.
- Whether client contracts require the firm to carry cyber coverage.
- Whether the cyber policy includes dependent business interruption and how it is defined.
Hardcover insight
Firms often focus on their own security and overlook the inboxes of the people they work with most. A consultant’s compromise can arrive looking like normal project traffic. A written payment rule and a quick look at contract language cost little, and they cover a risk that sits outside the firm’s own network.
Related questions
How can a hacked consultant affect my firm?
Attackers can use the consultant’s real email account to send you fake drawings, sign-in links or invoices. The sender looks trusted, so the message gets less scrutiny.
Should I verify payment changes from long-time subconsultants?
Yes. Confirm any changed bank details by phone, using a number you already have. A long relationship does not rule out a compromised account.
Do subconsultant agreements need cyber requirements?
That depends on the project and the contract. A contract check can show what the agreement says now and what may be worth reviewing.
What is dependent business interruption coverage?
It addresses income lost when an outside vendor the firm relies on goes down. Not every cyber policy includes it, and definitions vary.
Does cyber insurance cover fraud that starts with a consultant’s email?
It depends on the policy and what happened. A fraudulent payment may fall under social engineering or similar provisions. Review the wording or ask a broker.