The city of Hilliard, Ohio, suffered a financial loss of nearly $219,000 due to a phishing scam that targeted the city’s finance department. The threat actor pretended to be an existing vendor and persuaded the finance worker to change bank routing information for that vendor’s account. The finance director and his assistant, who received the email, believed it was legitimate and authorized the change, resulting in the funds being redirected to the hacker’s account. The incident was discovered in January during an internal review, and the city immediately reported it to law enforcement. However, the incident could have been made known sooner if the finance director hadn’t waited 35 days to report the issue. The finance director was fired as a result of improperly handling the incident, while the assistant resigned. The FBI and other agencies are investigating the incident, but so far, no arrests have been made. They also encouraged anyone who may have information about the incident to come forward and contact law enforcement.
Analyst Notes
The city has already taken some steps to prevent future scams, such as implementing multi-factor authentication and providing additional training for employees. However, they may also want to consider conducting regular security audits, hiring a third-party cybersecurity firm to assess their vulnerabilities, and establishing a response plan for potential future incidents.
https://www.usatoday.com/story/news/nation/2023/02/17/hilliard-ohio-fires-finance-director-phishing-scam/11282093002
