Get AI Briefings, Transcripts & Alerts on Local & National Government Meetings — Forever.
Pine Bluff School District discloses December wire-transfer cyberattack, says substantial recovery expected
Loading...
Summary
Superintendent Barbara Reed told the board a sophisticated phishing attack altered wiring instructions on a legitimate construction invoice and led to a $3.2 million wire transfer; the district says a federal investigation is largely complete and a substantial portion of funds are expected to be recovered.
Pine Bluff School District Superintendent Barbara Reed told the board on April 27 that a sophisticated cyberattack in December led to a wire transfer of $3,204,639.55 being sent to fraudulent wiring instructions inserted into a legitimate construction invoice email thread.
Reed said the district’s director of finance contacted the vendor and learned the company had not requested payment by wire; an employee email account had been compromised and fraudsters introduced fake wiring details into the same thread. The district notified its bank and law enforcement immediately and cooperated with a federal investigation. Reed said confidentiality was required while authorities worked to recover funds and that the investigation is now largely complete. A “substantial portion” of the funds is expected to be recovered, though an exact restitution amount has not been finalized.
The board was told the attack was not the result of an internal error but a coordinated criminal scheme. As immediate safeguards, the district implemented stricter wire-transfer procedures that require dual verbal authorization and independent verification, banned reliance on emailed wiring instructions without verbal confirmation and verified contact information, boosted staff training on phishing and fraud detection, and began an internal review of financial controls.
Board members asked whether the person who approved the transfer had to obtain prior checks and whether the attack had occurred previously. Reed said she approved the transaction with the bank’s notification, that the incident was unique and that the original federal timeline for the investigation was 60–90 banking days; officials were recently encouraged that funds recovery could materialize within two weeks.
The district also filed a claim with the Arkansas Cyber Response Board to seek available financial assistance for public-school cyber incidents. Reed said the district will continue to update the board and the public as authorities provide final restitution details.
