{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2021-peterborough-new-hampshire-loses-2-3-million-after-a-finance-mailbox-tak"},"incident":{"slug":"2021-peterborough-new-hampshire-loses-2-3-million-after-a-finance-mailbox-tak","title":"Peterborough, New Hampshire loses $2.3 million after a finance mailbox takeover","date":"2021-07","date_precision":"month","year":2021,"victim_org":"Town of Peterborough, New Hampshire","sector":"Government","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Vendor / Supply Chain Impersonation"],"ai_involvement":"No AI reported","ai_notes":"","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":2300000,"loss_kind":"direct_loss","loss_note":"About US$2.3 million diverted, roughly 15 percent of the town's annual budget; the US Secret Service recovered US$594,331 that had not yet been converted to cryptocurrency.","records_affected":null,"threat_actor":null,"summary":"The town of Peterborough, New Hampshire discovered in summer 2021 that about $2.3 million of payments had been diverted to fraudsters. The account of a town finance staff member had been compromised in April, and the attackers used it to redirect payments due to the ConVal School District and to a bridge contractor. The US Secret Service recovered $594,331; the rest had been moved on or converted to cryptocurrency.","how_it_worked":"After taking over a town finance employee's email account, the attackers read the genuine correspondence with two payees, the regional school district and a bridge construction contractor, both of which had asked to be paid by electronic transfer. They then inserted themselves into those live threads with revised banking details, and deleted the payees' incoming emails so that the real counterparties' queries never reached town staff. The town had procedures requiring notarised change forms and confirmatory phone calls, but staff who were supposed to check each other's work did not follow them, which is what let the diverted payments clear.","lessons":"Existing verification procedures only work if they are enforced; mailbox rule creation and mass deletion in a finance account should also raise an automatic alert.","confidence":"Confirmed","sources":[{"title":"Peterborough payment scam: Single compromised email account led to $2.3M theft","url":"https://ledgertranscript.com/2021/10/05/pbscam-ml-100521-42830401/","publisher":"Monadnock Ledger-Transcript"},{"title":"Cyber-thieves Scam New Hampshire Town Out of $2.3m","url":"https://www.infosecurity-magazine.com/news/cyberthieves-scam-new-hampshire/","publisher":"Infosecurity Magazine"}],"entry_type":"incident","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2021-peterborough-new-hampshire-loses-2-3-million-after-a-finance-mailbox-tak"}}