I was talking to a client recently; their e-mail system was compromised, and I believe that the hackers were still lurking in the system.
They had hired a new employee who received a text from the owner within the first week requesting that he go out and buy a bunch of gift cards on his behalf, the company would reimburse him.
He was on his way to lunch and passed the owner on the way out and once in his car, received another text again asking about the gift cards. This time he called the office and talked to the owner, only to learn that the phone number was spoofed, and this was a fraud request.
Once your system is compromised you have to ensure that your system is newly secured. My guess it that their e-mail system is still compromised, and the criminals got the owners personal cell number off of an e-mail, along with the new employee’s cell number.