Authorities are investigating how a hacker transferred more than $3 million from a Duanesburg Central School District account at NBT Bank to a number of overseas financial institutions during a five-day period last month.
NBT Bank was able to recover roughly $2.5 million of the stolen funds after discovering the online transfers on Dec. 22. The district’s account with NBT remains $497,200 short, but school administrators expressed optimism that they’ll be able to cover the shortfall as the FBI and state police investigate the theft.
“We remain confident that we will retain that money,” said Christine Crowley, Duanesburg’s superintendent, during a news conference at the Duanesburg Elementary School library on Tuesday. “I think the district can weather this until we know whether or not we can recover these funds through the FBI.”
The first unauthorized electronic transfer occurred on Dec. 18, when $1.86 million was moved from the district’s money market account to an overseas destination. Three days later, illegal transfers totaling more than $1.19 million were wired to multiple destinations outside the United States.
On Dec. 22, a third attempt to transfer money occurred, directing NBT to transfer $758,758 to a number of areas overseas. The transfer flagged the account for abnormal activity, prompting an NBT representative to contact the district to confirm the validity of the transactions.
Upon learning of the illegal transactions, NBT was able to deny the pending transfer from Dec. 22. Both the bank and the district contacted the FBI, which launched an investigation and helped recover $2,555,600 of the money.
The district also closed out all of its bank accounts, established new ones with restricted online access, hired an external auditor and ordered a bi-weekly review of all transactions. School officials are also requesting that all payments be sent and received via paper check until further notice.
Crowley declined to discuss further details of the theft other than to assure that no one from the bank or school district is a suspect. She said only the school’s business administrator, treasurer and payroll clerk — all longtime employees of the district — had access to the online account.
“Obviously, this incident has shaken our confidence,” she said.
The Albany division of the FBI and the state police are jointly investigating the case with assistance from the state Office of Cyber Security and Critical Infrastructure Coordination. All declined to comment.
Likewise, representatives from NBT refused to discuss the case, citing the privacy rights of the bank’s clients. Spokeswoman Florence Doller also declined to discuss NBT’s policy for monitoring accounts or the threshold of activity that might prompt suspicion.
“It is our policy to protect not only our customers’ funds but their privacy as well,” she said. “As this matter is related to a customer account and is subject to an ongoing investigation by law enforcement, we are not able to comment on it.”
The money still missing, amounting to about 3.3 percent of the $14.8 million budget voters passed last year, comes during a time when the district is already anticipating a difficult year for finances. Last month, the district had to contend with a $31,764 shortfall because of a delay in state aid ordered by Gov. David Paterson.
The governor also indicated other funding streams, such as School Tax Reduction payments, could be withheld as part of a strategy for dealing with the state’s fiscal crisis. In Duanesburg, the delay of STAR payments could result in a temporary $175,213 shortfall.
Last year the district narrowly avoided cutting seven full-time positions by using federal stimulus funding. District officials said it’s too soon to determine how the theft might affect the budget.
Board of Education President Carlos Moreno said “We don’t have anything concrete yet.”
The illegal transfer stirred ire among some of the roughly two dozen district residents attending the board’s regular meeting Tuesday. Some asked why the district wasn’t alerted about the transfers earlier, while others asked whether someone would ultimately be held responsible for the crime.
“It seems to me there were some leaks of information that occurred,” said Will Lape.
Duanesburg was audited by the state comptroller in 2008 and directed to make a number of changes regarding internal controls over its payroll and benefits appropriations. The audit, which reviewed the district functions between July 2005 and June 2008, also suggested the administration take stronger measures to back up the school’s computer data.
Comptrollers’ Office spokesman Bill Reynolds said it appears as though the district took all the necessary actions recommended in the audit. He was unsure whether the probe delved into the protection of account information, but said such issues have turned up in other schools.
“We’ve seen vulnerabilities like this at other districts,” he said.
Crowley said the investigation should eventually determine if the crime was preventable by the district. However, she said the audit didn’t mention any areas of concern regarding the security of the district’s bank accounts.
“Nothing in that audit report pointed to any concern about accessibility to online bank accounts,” she said during the board meeting.