The city of Arlington, Massachusetts is nearing completion of its new $234 million high school. But the Boston suburb is out of pocket for the uncovered portion of an insurance claim for $440,000 in stolen project payments made using emails that spoofed messages sent by project team members.
The crime is one of many schemes that have hit businesses and public bodies in recent years, including companies involved in construction projects.
City Manager James Feeney reports that the school’s crime insurance policy paid out the policy limit, $100,000.
This still leaves the city at a loss. Information about a deductible that may have applied to the policy and claim was not immediately available. It wasn’t either name of the insurer.
The multifaceted high school—already partially occupied and in use—took the city more than five years to plan and build. Skanska USA is the project manager and Consigli Construction is the construction manager.
In June, Feeney disclosed in a letter to residents that the city was working with local and federal law enforcement agencies and a specialized consultant after discovering what the insurance industry is calling a “mail compromise attack business electronic. Feeny said it had been launched from “a well” foreign organization that diverted four separate payments to the vendor.
City and project officials had been exchanging emails with the seller since September 2023, he said. The attackers ccompromised certain employee email accounts and tampered with inboxes, including deleting emails. The missing money was discovered in February.
The city, which has a population of 45,000, has since taken steps to strengthen its cyber and email security and the project will not be affected, Feeney wrote. Only $3,308 of the stolen funds had been recovered when the crime was first revealed.
