PHILADELPHIA (KYW Newsradio) — A City Controller's audit of the Philadelphia School District has turned up $700,000 paid to cyber thieves who posed as vendors.
The District pays its vendors with paper checks unless they request an electronic transfer. Thieves used a vendor's hacked email address to do precisely that, said Superintendent Tony Watlington.
"Last year there were two contractors who experienced incidents of cyber fraud, resulting in the District making payments totaling some $700,000 to third-party bad actors," Watlington said Thursday at a City Controller's news conference.
The district said a contractor's email was hacked by a third party, who used it to pose as the contractor and request an Automated Clearing House (ACH), or electronic, transfer. One March 2024 transfer of $563,151 was made for flood repair damage and three others for a total of $126,056 were made for special education services.
"These vendors were receiving paper checks, and it was requested to be diverted to ACH," Brady said.
The controller is asking the state attorney general to investigate, noting that the real vendors still haven't been paid.
"We're looking at hopefully recovering [the money]. So we're working together to see what is the result of this investigation to determine the steps going forward," Brady said.
Once the fraud was uncovered, the district notified the FBI and the district's inspector general, Watlington said.
"Following those incidents, to have rigorous controls we implemented a number of measures to enhance internal controls in this age of cyber fraud," the superintendent added.