The case only became public this week. Current RKIK director Elmar Vaher said he heard about it days ago and has not questioned staff involved.

The RKIK had already been at the center of scrutiny over payments made for a multi-million euro munitions procurement for Ukraine whose delivery failed to fully materialize.

Helena Jürgenson, an analyst in the analysis and prevention department at the Estonian Information System Authority (RIA), noted that falling victim to business email fraud says a great deal about an organization's processes and security.

"This is a type of fraud in which criminals put quite a lot of effort into the scam. An email account at an organization is taken over. The correspondence is monitored for a long time, and at the right moment an invoice is replaced," Jürgenson said.

Magnus-Valdemar Saar, who headed RKIK at the time of the fraud losses, said he could not remember the company's name and was unable to search for it; the department head and chief financial officer involved are still employed there, he said.

"I believe if you ask the relevant category manager who handled the invoice, they will be able to describe in considerable detail exactly what the trick was. RKIK's invoice processing procedure was already fairly technical before this incident — there were certainly around six pairs of eyes checking it," Saar told "Aktuaalne kaamera".

Asked why the fraud only became public two years later, RKIK's current director, Elmar Vaher, said he had heard about it a few days ago. "I don't know exactly what happened in 2024. The police have investigated it thoroughly and they can answer questions," Vaher, himself a former police chief, said.

Vaher said he has not questioned the category manager or chief financial officer about the matter. "These people have been questioned by the Estonian police. If Magnus-Valdemar Saar has provided explanations, then I guess that is how it was. I have no reason to doubt it."

Saar said that, as far as he could remember, he had also informed then-Defense Minister Hanno Pevkur (Reform) about the incident.

"I don't think we discussed it in much greater detail. It was not an incident that required more extensive management. There was communication with the State Shared Service Center, for example, and the ministry. RKIK notified the investigative authorities of the incident and also filed a criminal complaint," Saar added.

Saar noted that RKIK's security chief at the time had notified the police under his own name because he had to authenticate his identity using an ID card when submitting the complaint. He also confirmed that RKIK had introduced additional invoice processing procedures.

In 2024, RKIK signed four contracts with Datasel, an Italian firm owned by Indian-based Neco Defense Munitions, paying roughly €70 million in advance for artillery shells for Ukraine. None arrived, the contracts were terminated, and the state is pursuing the money through Estonian courts and Swiss arbitration. The scandal contributed to Defense Minister Hanno Pevkur's resignation on September 2.

In the first six months of 2026, police in Estonian authorities received 1,816 reports of telephone and online scams, with losses of €13.2 million.

--

Follow ERR News on Facebook and Twitter and never miss an update!