Town of Plymouth falls victim to cyber attack

PLYMOUTH, CT. (WFSB) - Plymouth police are investigating after town fund were stolen via a cyber attack.

According to police, a town vendor was victimized and had emails compromised.

Mayor Joseph Kilduff said the finance department sent money to one of the town’s vendors that was hacked but didn’t notice until it was too late.

$208,300 were sent between two payments.

According to the mayor, scammers were sending the finance department what appeared to be accurate invoices but those came with incorrect payment instructions which were never verified.

“The first thing you do when you get such a request. The first thing you do is verify. You try to authenticate it,” said Tirthankar Ghosh, Director of Connecticut Institute of Technology at the University of New Haven.

Ghosh from the University of New Haven weighed in on what Plymouth is calling a “social engineering scam.”

Those scams include cyber crimes from phishing emails to catfishing to extortion.

But no matter the method, the result is the same.

“The main goal is the same. The main goal is to gain someone’s trust in the process and then make them reveal some confidential information or do something that they aren’t supposed to be doing,” Ghosh said.

The thousands of dollars given out from the town have yet to be returned.

Ghosh says once you send that money, often it’s too late.

“Once the money has been sent out, I’m pretty sure you send it to fake accounts, and most times those accounts are already gone,” said Ghosh. “If you can identify those sources, you can go after them. Law enforcement is involved here and they can go after the source.”

Plymouth police are assisting the FBI in the investigation.

“Plymouth police were made aware that a town vendor was victimized by cyber criminals and had their emails compromised. The perpetrators were able to utilize the compromised emails to fraudulently obtain funds from the town of Plymouth,” Plymouth police said.

Plymouth’s finance director resigned effective immediately.

Ghosh says this should be a learning opportunity that all employees should be more aware of.

“We need to be really really mindful unless we know for sure who the call is coming from or the messages coming from,” said Ghosh. “Stop and think twice before you click on the link.”

Ghosh also suggested setting up employee training and creating fake cyberattack scenarios so employers can learn red flags to look out for and what not to do.

Meanwhile, the town is now looking to hire a new finance director.

The mayor said there is no suspicious criminal activity by a town employee and the lost money will be covered by insurance.