A phone scam caused the City of Aurora to lose nearly $1.1 million from city payroll bank accounts, officials said.
A city employee fell for the scam and disclosed “sensitive account information” on April 29 when they received a phone call from someone impersonating a bank representative, city officials said.
City officials became aware of the fraudulent payments shortly after the transactions occurred and “took immediate steps to mitigate impacts and begin recovery efforts” by notifying law enforcement, the city’s financial institution and hired outside cybersecurity experts, according to a statement from the city.
“Law enforcement agencies are working closely with financial institutions to recover a portion of the funds, while City leadership continues to coordinate with relevant partners to identify those responsible and pursue full recovery options,” Aurora officials said in a statement. “Given the increasing frequency of these types of attacks nationwide, the City carries insurance coverage designed to help mitigate financial losses from incidents of this nature.”
Officials said there is no evidence that the city’s network or data systems were compromised as of Thursday afternoon, however, the results of the financial institution’s forensic audit to determine whether there was an impact to any employee data stored on its systems has yet to come back.
“The city will continue to practice its internal procedures, security measures, and employee training programs to strengthen protections and help prevent incidents in the future,” officials said. “Cybercriminals are increasingly using sophisticated tactics that exploit trust and create urgency, making these types of scams a growing challenge for both public and private organizations.”
