I know of a number of oil companies who had tens, if not hundreds of millions of dollars stolen in 2016. Their accountants were spear phished and their outboxes were closely monitored. When an outbound invoice was sent the email was caught and then altered to show the fraudsters bank and routing numbers. Oil companies are notoriously slow to pay (and frequently take lots of nudging to get a payment out) so the payment never showing up didn't seem out of the ordinary.

It was all kept hush hush to prevent copycat attacks. It took intervention from the FBI and a big netsec firm to even figure out how it had happened.