Cybercrook Pay Day: Over $3 Million Stolen From NY School Bank

Cybercrooks have managed to hack into a New York school bank account to transfer over three million dollars from the accounts of the Duanesburg Center School District over the course of three days.

Since the hacking incident, the bank has recovered $2.5 million of the stolen funds, but $500,000 still remains missing.

Duanesburg is a town in Schenectady County, New York, with a population of under 6,000. The Duanesburg Central School District has about 1,000 students and an annual budget of under $15 million.

District officials learned of the fraudulent transfers when a NBT Bank employee called them on December 22nd to confirm several pending overseas transfers totaling $759,000. The bank stopped the unauthorized transactions and then notified the district that an additional $1,190,400 was transferred out of its accounts on the previous day and another $1,862,400 on the day before (December 18).

The FBI and the New York State Police were contacted, who immediately opened an investigation into the incident. Meanwhile overseas financial institutions were able to recover $2.5 million of the illegally transferred money. The district officials wrote in a letter to parents and community members, thanking NBT Bank for "aggressive pursuit of the stolen funds". However, $497,200 of Duanesburg taxpayers' money is still missing.

Chances are that the cybercrime started with a malware infection, like in many similar cases reported last year. However, there are certain aspects of this incident that suggest the fraudsters are not very skilled.

The money was transferred in high amounts. In previous cases, the attackers kept transfers under $10,000 to avoid being flagged by automated systems. Furthermore, the money was transferred directly to overseas accounts, which made it possible for the bank to recall it. Skilled fraudsters transfer the stolen money to the accounts of local individuals known as "money mules", who then withdraw and wire it outside of the country. Wire transfers cannot be reversed.

As a precaution, the district has closed all of its accounts and opened new ones with restrictions for online access. It is not clear what these restrictions are, but the FBI and the American Bankers Association recently recommended that online banking be made from dedicated computers, preferably not using Windows.