The victim's staff received a spoofed e-mail and transferred US$6.6 million to a fraudulent bank account in Oman.