2023 · Connecticut, United States

New Haven schools pay $5.9 million to a fake school bus company

In 2023 attackers read a school manager's mailbox, then posed as the bus contractor. Six payments went out before the real company asked where its money was.

Published · Sources checked · 2 min read

When
Late May to June 2023, disclosed August 2023
Who
New Haven Board of Education
Where
Connecticut, United States
Way in
A compromised school mailbox, then emails from an address imitating the bus contractor
Tactics
Mailbox compromise, reading vendor conversations, a lookalike vendor address, changed bank details
Loss or impact
Six payments totalling $5.9 million. At least $4.7 million expected to be recovered by November 2023

What happened

In late May 2023 attackers got into the mailbox of a manager in the New Haven school system. StateScoop described the person as the chief operating officer. For weeks the attackers read the conversations between the schools, their vendors and the finance office. Then they acted. In June 2023 the Board of Education made six payments meant for the company under contract to run its school buses. All six went to accounts the attackers controlled.

The bus company noticed first, by asking why it had not been paid. The city made the loss public around 10 and 11 August 2023. Mayor Justin Elicker called the people responsible criminals. The district paused electronic transfers other than payroll.

The email

The attack had two halves. The compromised mailbox gave the attackers knowledge: who the vendor was, what it was owed, and how payments were usually requested. Patch, quoting the US Attorney's Office, reported that the attackers used the compromised address to send test emails.

The second half was a fake email account that imitated the bus company. From that address the attackers asked for payments to new bank accounts. Because they had read the real correspondence, their requests matched the timing, the amounts and the tone the finance office expected.

Why it worked

A finance office trusts a request that fits what it already knows. Here every detail fit, because the attackers had copied it from the district's own mailbox. The request came from an address that looked like the bus company's. It arrived when a payment was due. It asked for the amount owed. Nothing in the message contradicted anything the reader knew.

The fraud surfaced only when the real vendor complained. By then six payments had gone out over about a month.

What it cost

The six payments totalled $5.9 million. About $3.6 million had been recovered by August 2023. In November 2023 federal prosecutors filed a civil forfeiture complaint to return more than $1.1 million seized from the scammers' accounts. WSHU reported then that at least $4.7 million of the nearly $6 million was expected to be recovered. No criminal charges had been reported in the sources.

What would have helped

Two controls, at the two halves of the attack. Stronger sign-in protection on staff mailboxes, with alerts on unusual access, makes it harder for an outsider to read a manager's mail for weeks. A call to the vendor on a number already on file, before any payment goes to new bank details, stops the second half even when the first succeeds.

What a warning inside the message would have shown. Antilure explains the sender of every message in its Details panel. It flags a sender domain that imitates a known one and a first message from a new address, and marks wording that asks to change payment details. Its banner then says: don't reply or pay, check with the sender another way.

Sources

  1. Business email compromise in New Haven, Conn., reaps $6M, Lindsay McKenzie, StateScoop, 11 August 2023.
  2. Federal officials seize $1.1 million lost in the cyberattack on CT school district, Sabrina Garone, WSHU, 13 November 2023.
  3. Feds Seeking To Get $1.2M Back To City Of Millions Stolen By Hackers, Ellyn Santiago, Patch, 13 November 2023.