Hackers stole more than $6 million from the city of New Haven, Connecticut through a series of cyberattacks, and the FBI and New Haven police are investigating, Mayor Justin Elicker announced Thursday.
Hackers reportedly gained access to the email account of the New Haven Public Schools’ chief operating officer in late May.
The mayor said the thefts occurred through what the FBI calls “commercial email compromise.”
Elicker said it appears the hackers were monitoring emails between the New Haven Public Schools director of operations, vendors and the city’s budget office, then impersonated the chief operating officer and various vendors and requested electronic money transfers to fraudulent accounts.
In all, six fraudulent payments were made, Elicker said.
Four were destined for First Student, the company the city uses for school bus service. Elicker said the four transfers totaled $5.9 million.
Two payments were to a law firm used by the New Haven Public Schools department and those payments were for $76,000.
Hackers botched another attempt in July because the city’s budget office denied it.
Elicker said the city learned of the attacks on June 23 when First Student contacted the city to find out when the company would receive payments.
The city immediately contacted the banks where the transfers were made and the police department, which then contacted the FBI and the United States Attorney’s Office.
The city has been able to recover $3.6 million so far, the mayor said.
He said the FBI has been able to freeze some additional funds and is working to recover funds that have not been recovered or frozen.
The FBI calls “commercial email compromise” scams “one of the most financially damaging online crimes.”
They said the criminals send an email that appears to come from a known source and makes a legitimate request. There is more information about this type of scam in the FBI website.
Elicker said the city of New Haven has halted all electronic transfers other than employee payroll transfers until further notice.
They are also working to strengthen cybersecurity and reach out to companies that specialize in cybersecurity.
Elicker said they don’t believe any city employees were involved in the scam itself, but an employee of the city’s legal budget office has been placed on paid administrative leave while the review continues.
Investigators are working to identify the hackers and determine how they were able to access the email.
