PETERBOROUGH — Town officials hope to recoup from insurance $2.3 million stolen from public coffers in a cyber scam this summer before considering other ways to raise those funds, according to Town Administrator Nicole MacStay.
Peterborough, which has a $15.8 million budget this year, doesn’t know yet whether the Concord insurance agency NH Primex will cover the lost money, she said Tuesday, a day after officials announced that the town had been defrauded by scammers posing as ConVal Regional School District staff, in addition to another scam.
MacStay declined to speculate whether taxpayers will have to make up the stolen funds, saying only that Peterborough is “focusing our attention on recovering those losses through insurance right now.”
“If we do find that we’re not able to, we’ll start exploring the other options that’ll be available to the town,” she said.
Town officials learned of the scam after a $1.2 million transfer meant for ConVal didn’t reach the district in July and payouts to a contractor on the Main Street bridge project also weren’t received, MacStay and selectboard Chairman Tyler Ward said Monday.
In a news release, they said they don’t believe those funds — which they said the U.S. Secret Service has determined were subsequently exchanged for cryptocurrency — can be recovered by reversing the transactions.
Peterborough has since paid Beck & Bellucci, the Franklin construction firm replacing the bridge, what it was owed, but remains a payment behind on its monthly obligation to ConVal, according to MacStay. The school district has been "very understanding," she said, and is working with Peterborough to ensure that any payment doesn't hamstring the town's finances.
Those delays aren’t expected to affect the school district, which has cash reserves to make up a short-term deficit, or the bridge project, which has been slowed by flooding from the Contoocook River due to heavy rains this summer, MacStay said Tuesday.
The scammers duped town finance staff by telling them via email that ConVal had changed banks and providing wire-transfer information for the fraudulent account, she said.
After learning that ConVal hadn’t received its monthly payment from Peterborough on July 26, three days after finance staff sent those funds, she said the town tried unsuccessfully to stop the transfer before notifying NH Primex of the incident.
Officials looked at all of Peterborough’s recent money transfers to see if any others had included a change in banking information, but ConVal’s was the only one it found, according to MacStay. The town didn’t put in place a more vigorous review process for subsequent financial transfers because it didn’t know then how the scam had happened, she said.
“We were unclear at that point whether or not the fraud had happened on our end or if it was on ConVal’s end or if it was somehow being intercepted between the two organizations,” she said.
ConVal Superintendent Kimberly Rizzo Saunders has said the district’s IT staff reviewed its email servers and anti-virus logs and found no signs of malicious activity.
Peterborough learned last week — while the Secret Service’s Cyber Fraud Task Force was still investigating the first theft — that two payments to Beck & Bellucci hadn’t arrived. The construction firm referred an inquiry Tuesday about the payment delay to Peterborough officials.
MacStay said Tuesday she doesn’t know how long the town, which has halted all ACH (Automated Clearing House) transfers and is issuing those payments via physical checks instead, will extend the pause. Peterborough staff are paid through a separate direct-deposit system unaffected by that change, she said.
Town policies for handling electronic money transfers are also under review by the Secret Service, which MacStay said told her that another northern New England community recently lost $600,000 in a similar scam.
Transfers like those meant for ConVal and Beck & Bellucci are reviewed by multiple people in Peterborough’s finance office, she said, adding that there are “checks and balances in our system that these criminals were able to … insert themselves into.”
While no town employees are believed to be criminally involved in the scam, MacStay and Ward said Monday, those who were directly targeted in the email fraud have been placed on leave pending the conclusion of the Secret Service investigation. MacStay said Tuesday that their absences won’t affect the finance department’s day-to-day operations. She said that the town has “redundancy” in that office, though she declined to specify how many people are on leave.
Declining also to share more on Peterborough’s financial protocols, she voiced concern about offering a cybersecurity “handbook for other criminals to take and use against other small towns.
“This is happening all over the place, so my real concern is to prevent any knowledge gained from our experience here being used against someone somewhere else,” she said.
U.S. Sen. Maggie Hassan, D-N.H., called the $2.3 million scam “devastating” in a Tweet, adding that “what happened here isn’t a rarity.”
Hassan’s office said in a news release Tuesday that the incident “further underscores the need for additional investments in state and local cybersecurity.”
Hassan, who visited a Keene Housing property Tuesday while touting the bipartisan infrastructure bill passed by the Senate earlier this month, has proposed a cybersecurity grant program for state and local governments that was included in that legislation, according to the release. The $1 billion program would give at least 80 percent of those funds to municipalities, including 25 percent to rural communities, and require states to submit a cybersecurity plan to federal officials.
Peterborough officials would likely apply for funding through that program, if enacted, MacStay said Tuesday.
“That is what we’re discussing at this time.”