It is being reported that the city’s treasurer raised red flags before Portland lost $1.4 million in a cyber breach. Hackers used a city email to trick employees into transferring money. The cybercriminals made off with $1.4 million in taxpayer money. This is being called the single biggest theft of funds in the city of Portland’s history. The $1.4 million moved from the city’s bank to an account on the East Coast. This is where it disappeared. The cybercriminals had total access to the city’s internal systems for an entire month.
Red flags were documented. Before the wire transfer went out on April 25, treasury officials reached out to the housing bureau asking staff to confirm Central City Concern’s banking information was accurate, according to an email sent by city treasurer Brigid O’Callaghan. O’Callaghan was concerned the name on the bank account for Central City Concern did not match the name of the account receiving the wire transfer.
According to an email exchange the loss could have been easily avoided. The records show the city’s treasury flagged the $1.4 million wire transfer as potentially fraudulent before the money left Portland’s coffers. The housing bureau officials paid it anyway. The cybersecurity experts say there’s little chance the city will get it back.
The million-dollar-payment was intended for Central City Concern, a local nonprofit building a 100-unit affordable housing project called The Starlight in the heart of the Old Town neighborhood. The city’s housing bureau signed a $17 million contract with the nonprofit last March to construct the building and had been routinely wiring the group money to cover construction costs.
One month after the first fraudulent transfer, hackers would make a second, unsuccessful attempt to steal money. Only then would city officials realize the payment originally flagged as suspicious was indeed fraudulent.
No one at the nonprofit ever confirmed the transfer. Emails show a housing bureau official was in contact that day with someone purporting to be Central City Concern’s treasury manager who had the nonprofit’s logo at the bottom of his email. The person’s email is redacted in the documents the city provided.
