The V.I. Water and Power Authority is claiming it fell victim to an email scam last year when it authorized two wire transfers — totaling more than $2 million — to an offshore account.
A news release Friday from the utility indicated that, on two separate occasions in 2018, the utility experienced a “business email compromise,” a type of scam in which a fictitious email appears authentic and targets companies that conducts wire transfers.
The incident resulted in utility funds totaling $2.2 million being authorized and sent to an apparent legitimate vendor, according to the release.
The FBI is investigating the incident.
Utility spokesman Jean Greaux Jr. declined to comment on the incident, citing the ongoing investigation.
Utility Executive Director Lawrence Kupfer, however, indicated in the release that financial control procedures have been revised, and cybersecurity training for staff, as well as training on recognizing phishing emails that can lead to such scams, have taken place.
“The training is recurring, and we use controlled phishing emails to test our employees’ ability to determine authentic from bogus emails,” said Kupfer in the release.
“While we can say very little until the federal investigation into the incidents is complete, I thought it prudent, in light of the Senate discussion this week, to reassure the community that while WAPA was victimized by the [email] incidents, we have taken all advisable security measures to ensure an incident of this nature does not recur,” he said.
Employees with corporate or publicly available email accounts, and who conduct financial transactions or wire transfers, can indeed be tricked or compromised through keyloggers or phishing attacks, according to the release.
Kupfer said the utility’s networks, customer information, computer systems and its overall digital infrastructure were not compromised.
Earlier this week, Kupfer, who testified before the V.I. Legislature on the financial state of the utility, came under fire after addressing the incident.
“It is now a full year since these transactions took place and we have very little information,” said Sen. Kenneth Gittens in a statement following the hearing. “I am urging WAPA to aggressively pursue the return of these funds and work to see that such a thing does not occur again. This is a serious matter. We must take all steps necessary to eliminate waste, fraud and abuse of our resources.”
Senate President Novelle Francis Jr. also expressed disappointment in the utility, particularly in its late notification of the incident to the Legislature.
Francis said he intends to hold an “investigative hearing” to determine how this incident occurred.