City of Pittsburg says it fell victim to $913K phishing scam based in Nigeria
By Tim Fang
Officials in the City of Pittsburg disclosed that it lost nearly $1 million in a phishing incident earlier this year, adding that most of the money has been recovered.
The city released a statement on Wednesday about the Feb. 12 incident, in which an unauthorized ACH payment of $913,839.81 was sent to a fraudulent account that was spoofing a known city vendor.
“Sadly, Pittsburg has joined a long list of public agencies successfully targeted by international crime rings with cyber-based financial crimes. This crime is both upsetting and a hard lesson for how we can improve our security. I share the community’s disappointment that criminals were able to exploit our systems,” Mayor Dionne Adams said.
Officials said the investigation has reached a point where public disclosure will not compromise the investigation.
City staff learned about the incident on Feb. 17 and informed Pittsburg police, who in turn contacted Contra Costa County officials and the FBI.
“The instant this incident was identified as fraudulent by City staff, the City’s Police Department acted quickly and immediately froze the account to which the funds were electronically wired,” police chief Phil Galer said.
Officials said swift action by police resulted in $696,241 being recovered. The city is pursuing an insurance payment for the remaining $217,598.
During the investigation, which included 18 search warrants involving 116 accounts, authorities said the prime suspect responsible for compromising the city’s email system was based in Nigeria, with at least two suspects based in the U.S. Officials said the investigation remains ongoing, as the FBI and U.S. Attorney’s Office accepted the case.
Following the incident, the city said it implemented new processes to strengthen internal controls when it comes to financial processes. Changes included improvements to ACH payment verification processes and modified IT staffing.
Pittsburg has joined other communities in and around the Bay Area that have recently dealt with cybersecurity incidents. In March, Foster City was hit by a ransomware attack that led to disruptions of all public services outside of emergency services.
Last October, San Benito County fell victim to a suspected phishing incident, in which the county paid nearly $700,000 to someone posing as a construction contractor. After being alerted by a bank, the transaction was reversed and the money was recovered.
