@JeremyCherfas @hazardwarning Most unfortunately, the last update I got was that, because the CEO's email wasn't compromised — my friend simply didn't notice it was the same username but a different domain — the company may not be able to provide any reimbursement.
My hope is that the CEO (she's only the regional CEO) just needs time to consult with the head office.