Here in the US it's the employees that get stolen from the most.

Big numbers like that certainly show that training (of employees to not get phished) is worth it.

Somewhat lucky for everyone that in this case it was "only" money, no security or data breach, which has more lasting damage.