ST. CHARLES PARISH, La. — St. Charles leaders are just now learning about a cyber-attack involving a parish vendor.
According to Deputy CAO Samantha de Castro, “a third-party vendor’s email system was compromised, enabling a threat actor to provide St. Charles parish with the appropriate documentation needed to change the vendor’s banking information. With the updated information provided, a scheduled invoice payment was made to the new account.”
The parish did not reveal the company's name or the amount of the payment, but sources tell WWL Louisiana it was for more than $1 million.
Local and federal law enforcement launched an investigation after the vendor contacted the parish inquiring about the payment status.
New Orleans cyber security expert George Schiaffino said the hacker was more than likely able to convince someone who had an email account with the vendor to give up his or her password.
“Once that person gives up their password, they kind of go through the email account and see what kind of communication is happening and then they can start to modify invoices, send modified banking information,” Schiaffino said.
According to the FBI, this sort of scam is all too common.
Last year, the bureau received more than 21,000 email compromise complaints, with losses totaling more than $2.9 billion.
In Louisiana alone, the FBI received 167 complaints with losses of more than $17.5 million.
“With this type of a situation, the best practice is to follow up with a call, not to the phone number that’s in the email, but to a phone number that’s looked up in your paperwork and call that individual and confirm that this banking account information has truly changed,” Schiaffino said.
According to St. Charles officials, the parish’s systems were not compromised during this event and remain secure.
► Get breaking news from your neighborhood delivered directly to you by downloading the new FREE WWL-TV News app now in the IOS App Store or Google Play.