Many years ago in 2012, CSO online (see link) reported that in Project Mayhem, security researchers have presented proof-of-concept code capable of accessing the database driving a Microsoft ERP system and then diverting funds while avoiding immediate detection. The ERP system in question was Dynamics Great Plains.

As the artcile points out, what this ability to hack into ERP systems emphasises is the importance of 'separation of duties' in terms of the setup of rights and roles and the need to have some way to check 'unusual' transactions e.g. large payments to a new vendor or funds transferred to a new bank account. I'm sure you can point me quickly to the 'unusual transactions' report that is provided out-of-the-box from your ERP system?

Time to face up to the fact that any ERP system is a great example of big vulnerable data that accounting-aware hackers could play havoc with. This is even more likely to be the case today when so many ERP systems are in the cloud, along with all their data.