The city of Arlington, Massachusetts is nearing completion of its new $234 million high school. But the suburban Boston city may still be seeking settlement of insurance claims to recoup some of the $440,000 in payments to an unidentified project vendor stolen through a scheme carried out using emails impersonating messages sent by members of the project team.
The crime is one of many schemes that have hit businesses and public bodies in recent years, including companies involved in construction projects.
The multifaceted high school—already partially occupied and in use—took the city more than five years to plan and build. Skanska USA is the project manager and Consigli Construction is the construction manager.
In June, Arlington City Manager James Finney revealed in a letter to residents that the city was working with local and federal law enforcement agencies and a specialist consultant after discovering what the industry of insurance calls it a business email compromise attack. Finney said it had been launched from a “well-resourced” overseas organization that diverted four separate payments to the seller.
City and project officials had been exchanging emails with the seller since September 2023, he said. The attackers ccompromised certain employee email accounts and tampered with inboxes, including deleting emails. The missing money was discovered in February.
The city, which has a population of 45,000, has since taken steps to strengthen its cyber and email security and the project will not be affected, Sweeney wrote. To date, only $3,308 of the stolen funds have been recovered.
Arlington, he added, is responsible for the loss and has filed an insurance claim to try to recover some of the funds. City officials could not immediately be reached by email and phone for an update on the investigation and the insurance claim.
