Burlington, Ont., recovers most of $500K lost in 2019 phishing scam

The city of Burlington, Ont., has recovered most of the roughly $500,000 it lost in a 2019 scam andhas sinceupped its security game, says Mayor Marianne Meed Ward.

"They say, 'It's not if it's going to happen to you, but when,'" Meed Ward said in an interview last week. "We've already had our when, we got our money back, and we've made steps to make sure that this will never happen to us again."

As CBC Hamilton previouslyreported,the fraud occurred in May 2019, when a city worker responded to what turned out to be a phishing email to change banking information for an existing vendor, and sent $503,026.66 toa falsified bank account.

Meed Ward said that's a significant amount, representing about a 0.25 per cent property tax increase. And she said she worried Burlington wouldn't ever get the money back.

"When this first happened to us, we were told the odds of finding out who it was and recovering the money [were low] because it moves very quickly between accounts. But our staff acted really quickly as soon as they realized the mistake."

'A successful resolution,' staff say

The city has been attempting to get back the money in the years since.

Last month, it recovered $100,000 of the lost money, followingcriminal court proceedings against one person connected with the fraud,according to a Dec. 6 report to the city's audit committee fromJustyna Boroch Hidalgo in Burlington's legal department. The money was paid back to city as part of a plea negotiation.

The city also negotiated with its insurer to claim $250,000 under the insurer's cyber crime policy, said the report.It recovered over $72,000through civil litigation as well.

Metro Morning7:38A month after a cyber attack took out many Toronto Public Library services, a library manager speaks out

Jan Dawson is an area manager with Toronto Public Library, responsible for 18 branches in Toronto's west end.

That brings the total recovered to over $422,000 about 84 per cent.

"At this time staff are of the view that the maximum amount of recovery has been achieved with all viable options for recovery fully explored and exhausted," the report said.

"Given the complexity of this matter, [84 per cent] is a relatively high rate of recovery and a successful resolution for the city."

Meed Ward said Burlington has improved its cyber securitypractices and training since the incident, ensuring employees know how torecognize phishing, and automatically screening incomingemails.

This year, Ontario institutions includinglibrariesandhospitals have been the targets of cyber attacks.

"Every organization is a target. If you have money and if you have a database of names, then you are a target," Meed Ward said."It's really as simple as that."