Breach report · Government
$1.04M Lost in Business Email Compromise Scam
A fraudster posing as a construction company CFO tricked City of Saskatoon staff into rerouting a payment, costing the municipality $1.04 million.
The city of Saskatoon has become the latest victim of cybercrime as $1.04 million has been stolen in a Business Email Compromise Scam. The municipality held an urgent press conference announcing that a bad actor, posing as a Chief Financial Officer from a prominent construction company, tricked city staff members into changing the receiving bank of a large payment.
City Manager Jeff Jorgenson told reports that despite city policies, “clearly, the control that was used wasn’t strong enough to prevent (the fraud).” He continued, “What I would say is internal and external staff who are experts in this area are reviewing all financial processes and controls in this area.”
While further details of the fraud are not available, what we do know is that the bad actor either spoofed or hacked the email of the construction company in order to trick the city staff into thinking they were dealing with the actual CFO.