Tri-town Selectmen get to the bottom of ORR cyber breach
A six-figure cyber breach in 2011 was the top subject of the Tri-town Selectmen’s meeting on Thursday night as they sought answers from Superintendent Doug White and the Old Rochester Regional School Committee.
White related the course of events from 2011. On February 8 of that year, $134,767 was stolen from an ORR account with Unibank. Unibank notified the school business office the following day and worked with then Business Administrator Katie Isernio.
“Katie was working very closely with the bank security officer, FBI and insurance officer to get as much of the money back as we could,” said White.
Of 20 fraudulent transactions, all but approximately six were stopped before the transfers were completed. A total of $33,774 could not be recovered.
The source of the problem, said White, was one computer on which some security updates had not been done. The theft was not related to anyone in the school.
Town officials wanted to know why they were not informed of the breach at the time.
“I think a heads up right away could certainly protect the possibility of other problems,” said Mattapoisett Town Administrator Mike Gagne.
“It was not a topic of discussion as to who do we tell,” said former School Committee Chair Peter Bangs. “At the time, it was under executive session. I certainly didn’t know which parts of the conversation could be made public.”
Bangs said he was unsure what information could be communicated as the breach was part of a larger, ongoing FBI investigation.
“There was no conspiracy in the committee,” said current Chair Jim O’Brien.
Gagne also asked for clarification on the amount. He said White originally told him $600,000 was stolen. White said he may have stated the wrong number as their initial conversation happened before he reviewed the files.
Town officials also wanted to know why the remaining $33,774 was never recovered.
According to White, records do not indicate that the school’s attorney was asked to pursue compensation from the bank.
“I think it would be unlikely,” said attorney Joshua Coleman, of Collins, Loughran & Peloquin. “The bank didn’t find any fault internally on their own end. It was a software issue on the part of the district.”
A different attorney from the firm handled the 2011 breach.
Selectmen asked White to work with Coleman to see if the money could be recovered.
Rochester Selectman Rich Nunes asked how the missing money was reflected in the ORR account.
White said all the information was given to ORR’s auditors at the time, but it was not identified in the auditors’ report.
“That’s why we don’t have that auditor any more,” he said.
To improve overall communication with the public, Mattapoisett Selectman Paul Silva questioned why the ORR and Joint committees aren’t videoed.
“I am formally asking you to consider that, and I’d like a response back,” said Silva. “I feel people would feel a lot more comfortable about everything that’s being done.”
White emphasized that there have been no other breaches since 2011. He is also looking into cyber insurance coverage, which did not exist in 2011.
While Selectmen expressed their concern about the lack of information communicated, Mattapoisett Selectman Jordan Collyer also applauded the efforts of the school district that resulted in most of the money being recovered.
“It could have been a lot worse,” he said.