Business email compromise in New Haven, Conn., reaps $6M

Bad actors stole more than $6 million from the public school system in New Haven, Connecticut, through a compromised email account, city officials revealed Thursday.

The New York Times reported that cybercriminals gained access to the email account of the school system’s chief operating officer in May and monitored conversations between the COO, vendors and the city’s finance office. They impersonated the COO and vendors to request payments to fraudulent bank accounts. 

Six payments totaling $5.9 million were directed to fraudulent accounts in June, and $3.6 million has since been recovered, Mayor Justin Elicker said during a recent news conference Thursday.

“The individual or the individuals that did this are criminal,” Elicker said. “They are unbelievably unethical to not only steal money from the public, but steal money from New Haven public school children.”

The theft was discovered when a school bus company contacted the school district to ask why they hadn’t been paid. The city reports it’s working with the FBI and has temporarily stopped its use of electronic money transfers, except for employee payroll.

The FBI has warned that business email compromise schemes are on the rise against state and local governments: Between 2018 and 2020, BEC payouts from local governments ranged between $10,000 to as much as $4 million.