What happened
Eagle Mountain is a city in Utah County. In August 2022 it sent one ACH payment of nearly $1.13 million for work on a major infrastructure project. The account did not belong to the vendor. The city determined it had been the victim of cybercrime and announced it on 12 September 2022. It contacted the FBI, the Utah County Sheriff's Office and the vendor, and filed an insurance claim.
Two years later, on 3 October 2024, the city announced a settlement with the construction contractor. It said it had recouped $400,000 in total, and that it had found no breach of its own internal systems.
The email
The Deseret News reported that someone inserted themselves into an ongoing email thread, posing as a representative of the vendor. Inside that conversation they persuaded city staff to send the payment to a different account. Utah Public Radio described the same thing: the perpetrator got into an email thread and redirected the payment.
This is thread hijacking. The attacker does not start a new conversation with a stranger's message. They join one the victim already trusts, often by answering the last message in it. Earlier messages sit underneath, with real names, real invoice numbers and the real project. The request to pay a new account arrives as the next step in a familiar exchange.
Why it worked
People judge a request by its context. A reply in a thread about a project they are working on carries all the context they need. It quotes their colleague. It mentions the invoice they expect. Nothing about it looks like the phishing emails people are trained to spot.
The city found no breach of its own systems. The public record does not say how the impostor got into the conversation. In other documented cases the attacker either controls a mailbox on the vendor's side or writes from an address that differs from the vendor's by a character or two. Both look the same to a busy reader.
What it cost
The city lost nearly $1.13 million on one payment. The 2024 settlement and other efforts brought back $400,000 in total. The city also tightened its policies for ACH payments.
What would have helped
The rule that defeats thread hijacking ignores the thread. Any change to where money goes is confirmed by calling the vendor on a number already on file. The more convincing the email chain, the more the call matters, because the chain itself may be the attacker's work.
What a warning inside the message would have shown. Antilure checks each message on its own, including replies deep in a thread. It flags a message from a name that used to come from another domain, replies that go to a different domain, and wording that asks to change payment details. Its banner then says: don't reply or pay, check with the sender another way.
Sources
- Eagle Mountain lost nearly $1.13 million in organized cybercrime, city leaders say, Ashley Imlay, Deseret News, 12 September 2022.
- Eagle Mountain loses nearly $1.13 million to an email impersonator, Caitlin Keith, Utah Public Radio, 12 September 2022.
- Eagle Mountain City reaches settlement with contractor following loss of $1.13 million, Eagle Mountain City, 3 October 2024.