It was announced at a Pine Bluff school board meeting on Monday that a cyber thief stole $3.2 million through a phishing e-mail scam.
PINE BLUFF, Ark. — Pine Bluff School District Superintendent Dr. Jennifer Barbaree broke her silence Monday evening after a cyberattack that cost the district millions.
According to district officials, the incident happened on December 17.
In a statement, and now confirmed during a board meeting, officials say a wire transfer of more than $3.2 million was processed for what staff believed was a legitimate invoice tied to the construction of the new Pine Bluff High School.
“The company had sent the invoice for construction services rendered, but the company had not requested the invoice to be paid via a wire transfer,” Dr. Barbaree said.
Instead, officials said hackers gained access to a district email account and inserted fraudulent wiring instructions into what appeared to be a normal email thread.
It’s a type of scam known as a business email compromise.
“Fraudulent wiring instructions were later introduced in the same email thread through a phishing scheme designed to closely mimic authentic communications,” Barbaree said.
The district said that’s when leaders contacted the FBI and the banking institution to launch a federal investigation.
“We were directed to maintain strict confidentiality; sharing details publicly at this time could have compromised the investigation and potentially hindered efforts to recover the funds by law enforcement,” Barbaree said.
We reached out to the district and stopped by the administration center on Tuesday for additional comment. District leaders declined an on-camera interview, citing the ongoing investigation.
We also reached out to East Harding Construction, the company connected to the project. We received this statement, which is in full below:
East Harding Construction is the construction manager for the new Pine Bluff High School. We followed our standard protocol for submitting a Pay Application. We were not aware of the cyberattack until the District informed us after it happened. We immediately notified our network provider and confirmed that our IT systems were not compromised and put additional safeguards in place to remain as secure as possible.
District officials said they expect to recover a substantial portion of the money as the investigation nears completion.
“We were encouraged that within the next two weeks, the recovery of funds would be available, would be back in our bank,” Barbaree said.
Additional questions were asked during Monday’s school board meeting. One director asked Dr. Barbaree why the board was not informed.
“I was told not to speak about it,” Dr. Barbaree said. “It would be compromised, because at the time, we didn’t know where the money was and who did it, and we still don’t know who did it.”
District officials said new safeguards have since been put in place to prevent future cyber attacks.
The FBI said that it cannot provide any additional details at this time due to the ongoing investigation.
