ARLINGTON, MASS. (WHDH) - The Town of Arlington lost nearly $446,000 as a result of an elaborate wire fraud scheme by an organization overseas, according to Arlington Town Manager Jim Feeney.
No sensitive or resident data was compromised, Feeney said, but the bank was only able to recover $3,308 of the $445,945.73 the town was defrauded. The scheme began in September 2023, and involved phishing, spoofing, social engineering, and compromised email accounts, Feeney said.
Town employees received legitimate emails from a known vendor working on the Arlington High School Building Project to figure out payment processing issues, but an overseas organization had already compromised some employee user accounts and were monitoring emails, Feeney said.
The organization pretended to be the known vendor with an “email domain that appeared genuine” and asked town employees to change their payment method from check to electronic funds transfer (EFT), which Feeney said is a common payment method used by towns and cities.
The organization also allegedly fabricated and deleted emails from town employee accounts and configured inboxes so certain incoming messages were hidden, he said.
A series of four monthly payments were made to the overseas organization until the legitimate vendor reported not receiving payments in February 2024, Feeney said.
“It was immediately apparent that we had been defrauded, so we alerted law enforcement and our banking institution, began a digital forensics investigation, retained a breach coach, and instituted immediate response measures to secure our network,” Feeney said.
The town filed a claim with its insurer to “hopefully further offset the loss” in addition to the $3,308, Feeney said. The loss will not negatively impact the completion of the Arlington High School building in any way, he emphasized.
Other attempts to intercept wire payments totaling about $5 million were discovered, but were unsuccessful, he said.
Since 2020, other Massachusetts municipalities including Tewksbury, Franklin, Quincy, Lowell, and Concord have all been victims of cyberattacks, Feeney said.
(Copyright (c) 2024 Sunbeam Television. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed.)