Slashdot reader lowvisioncomputing shares a story from the CBC about an elaborate heist discovered “when the chief administrative officer of a southwestern Manitoba rural municipality [population: 3,300] noticed the series of unusual cash withdrawals from its bank account….”
It began with a job advertisement. A seemingly legitimate company, with a professional website and a Nova Scotia address, claimed it was looking for cash processors. The contract was for one month. Employees could work from home.
They were told they would receive payments to their credit cards, which they would be expected to move to their bank accounts. They would then withdraw the payments, convert them into bitcoin, and send that to another account…. The majority of the 18 people hired were young and lived in various communities across the country…. Anyone who did an internet search for the company would find a professional website, with information matching what was provided in the employment agreement.
In early December 2019, the cybercriminals sent a phishing email to multiple people at the municipal office of WestLake-Gladsone, a municipality about 150 kilometres west of Winnipeg, on the southwestern shore of Lake Manitoba. At least one person clicked on the link, which allowed the hackers to get into the municipality’s computers and bank accounts. But weeks went by and nothing happened, so the municipality didn’t report it to the police. It was only after the money disappeared that the municipality discovered the two incidents were connected, said Kate Halashewski, who at the time was the assistant chief administrative officer for the Municipality of WestLake-Gladstone….
Court documents say that on Dec. 19, 2019, a person logged into the municipality’s bank account and changed the password, along with the personal verification questions. Over the next 17 days, the cyberattackers added the 18 “employees” hired as payees and began systematically making withdrawals, transferring the money to the employees’ credit cards. Dozens of withdrawals were made, totalling $472,377, according to court documents — a considerable amount for a municipality with an entire annual budget of $7 million.
Those withdrawals weren’t discovered until Jan. 6, when Halashewski saw 48 bank transfers — each less than $10,000 — going to unfamiliar accounts…. Once they’d completed the initial transfers and conversion, the bitcoin was then sent to the private account of the scammers — who cybersecurity experts say likely aren’t in Canada….
The municipality finally announced it had lost nearly half a million dollars in an Oct. 12, 2020, news release…. No arrests have been made in connection with the WestLake-Gladstone cyberattack and RCMP say it is no longer under active investigation.
Read more of this story at Slashdot.
