New Haven Public Schools $6M COO-email vendor thread-hijack BEC

What happened

Attackers gained access to the email account of the New Haven Public Schools chief operating officer and then read it quietly. The federal forfeiture complaint says they reviewed traffic inside the breached account for at least approximately one month before acting. Mayor Justin Elicker described the thefts themselves as running from late May through mid June 2023, and the city's later forensic investigation dated unauthorized access to city email accounts containing personal information to 1 June through 18 June 2023; no source gives a forensic date for the initial compromise. In early June the compromised mailbox was in live correspondence with school bus contractor First Student about an outstanding payment of about $5.9M. The attackers created a new email address designed to look nearly identical to the bus company's, ran test messages between it and the compromised account, then used the fake address to ask the school board and the city how to change the bus company's payment information. Staff directed them to the city's online portal for paying vendors, where they changed the banking details themselves, and on or around 12 June they emailed the Board of Education to confirm the update and invite payment of the balance. New Haven's finance office processed six fraudulent electronic transfers: four totaling more than $5.9M paid between 15 and 23 June, and two totaling about $76K meant for law firm Shipman & Goodwin. A seventh attempt in early July impersonating cleaning contractor S.J. Services was denied, because the budget office had already frozen electronic transfers. The fraud surfaced on 23 June when the real First Student asked why it had not been paid. The city notified New Haven police, the FBI, and the U.S. Attorney's Office, and stayed publicly quiet until 10 August 2023 at the FBI's request. About $3.6M was clawed back through JPMorgan Chase's ACH hold-harmless process, and in November 2023 the U.S. Attorney for the District of Connecticut filed a civil forfeiture complaint against a further $1,187,677.94 traced to two TD Bank accounts. The incident is documented in U.S. Attorney releases, in the city's own public notice, and in local and national press, making it a confirmed, real incident.

How it worked

This was a vendor thread-hijack business email compromise (BEC). Because the attackers were inside a legitimate executive mailbox, they saw the exact real invoice, amount, timing, and personalities of an in-flight transaction, so their impersonation required no invented pretext. They exploited the trust of an existing vendor relationship and the routine nature of a budget-approved payment: the chief operating officer had authority to authorize transfers already approved in the budget, so the requests looked normal. Controlling both sides of the conversation, the attackers never had to talk anyone into moving money to a new account. They asked a procedural question instead, how does a vendor update its payment information, and city and school board staff answered it. The answer was the city's self-service vendor portal. Once pointed at it, the attackers rewrote the vendor's banking record with their own hands and then reported the change back from the same address that had asked how to make it. Nobody verified the new instructions with First Student through a channel the attackers did not control.

The lure and the tell

Lure: emails that appeared to come from the trusted district chief operating officer and from the district's own bus contractor, referencing a genuine outstanding invoice, asking how to update the vendor's payment details before an imminent large payment. Tells: a vendor suddenly writing from a new address that only closely resembled the one already in the thread, a mid-transaction change to established banking details, and a confirmation that the change had been made arriving from the same address that had requested it. The decisive missed check was that no one verified the new payment instructions with the vendor through a known, independent channel. A call to First Student on the number already on file would have exposed the swap.

Outcome

About $6M was diverted. Roughly $3.6M was returned by JPMorgan Chase under an ACH hold-harmless agreement in August 2023, and the government seized and forfeited $1,187,691 more, announced in April 2024, taking recovery to about $4.79M at that point. The city put total recovery at about $5.1M in June 2024 and at $5.175 million of the $6 million stolen in October 2025, leaving roughly $825,000 outstanding. No public source accounts for the increase after April 2024. Of the traced money, $245,500 had gone to a bank handling currency for the Crypto.com exchange and was dissipated beyond recovery. No arrest or criminal charge has been publicly reported as of October 2025.

New Haven halted all electronic transfers except payroll and reverted to paper checks, hired outside cybersecurity and financial-controls consultants funded partly by cyber insurance, and pursued insurance coverage for the outstanding loss. In March 2024 it appointed its first chief technology officer, covering both city and school district IT.

The personnel outcomes were neither uniform nor quick, and this case should not be read as the story of one employee who erred. A city finance department employee was placed on paid administrative leave in 2023, explicitly not as a suspect, and returned to work in November 2023 after a third-party investigator found that the employee had done nothing wrong, violated no city policy, and was not at fault. Two Board of Education employees, the IT director and the senior IT information specialist, were placed on paid leave in February 2024 over performance-related concerns. The district dismissed the IT director in September 2024, stating that the director had failed in the performance of the role's duties following a lengthy administrative investigation prompted by an outside cybersecurity firm's evaluation of the department. An arbitrator reinstated the director a year later, finding that the city and Board of Education did not have just cause, calling the director's testimony credible and the termination arbitrary, unreasonable, and not based on the facts presented; the mayor said publicly that he still considered the dismissal justified. The director returned to work on 2 September 2025. The chief operating officer whose mailbox was compromised was placed on administrative leave in June 2024 and remained on leave that September. Officials said throughout that no city employee was believed complicit. Individual culpability here remains contested on the public record, which is why this file describes roles rather than people.

The same intrusion also exposed personal data. In June 2024 the city notified 404 individuals, among them city employees, retirees, and vendors, that personal information held in the compromised email accounts could have been accessed between 1 June and 18 June 2023. The exposed fields varied by individual and included names, dates of birth, Social Security numbers, driver's license numbers, financial account numbers, individual tax identification numbers, and health insurance or medical information. The city said it was aware of no resulting fraud or identity theft and offered a year of credit monitoring.

The FBI and the U.S. Marshals Service investigated, and the U.S. Attorney's Office for the District of Connecticut brought the forfeiture actions.

Why it matters

It shows how a single compromised executive mailbox turns generic phishing into a high-precision, low-suspicion fraud: the attackers never had to fabricate a scenario, because they used a real invoice and real relationships, which defeats any instinct to ask whether a request seems plausible. The sharper lesson is about the payment plumbing. The city's portal treated whoever could write convincingly as the vendor as though they were the vendor, which handed the impersonator the keys to New Haven's own vendor master data. Every organization that lets suppliers maintain their own banking details online carries the same exposure, and the control that closes it is a callback to a number already on file plus a hold on the first payment after any beneficiary change. The case also shows that public entities are attractive BEC targets, and that a look-alike sender address needs no domain registration, so the controls aimed at typosquatting can be in place and still see nothing. Rapid detection and immediate bank and FBI engagement are what made the partial clawback possible. The aftermath carries its own lesson: four staff across the city and the district were removed from duty at different points over two years, the one dismissal was overturned by an arbitrator for lack of just cause, and treating a control failure as an individual failure proved to be its own kind of risk.

Defenses

Treat any change to vendor banking details as a high-risk event, wherever it originates. If suppliers maintain their own payment information in a self-service portal, bind portal access to a verified identity, alert the finance team on every beneficiary change, call the vendor back on a number already on file to confirm it, and hold the first payment after any change. Never coach an inbound correspondent through the change process, because the request and the confirmation then arrive from the same unverified address. Enforce phishing-resistant MFA on executive and finance mailboxes and monitor them for anomalous logins, auto-forwarding, and new inbox rules. Because a look-alike address needs no registered domain, do not lean on typosquat monitoring or DMARC alone: turn on external-sender banners, alert on mismatches between display name and underlying address, and make it a rule that an established vendor's contact address does not change mid-thread without verification. Separate duties so that no single role can both change payment instructions and approve the transfer, and require dual authorization on large transfers. Report suspected BEC immediately to the bank and to the FBI or IC3 to keep the ACH and wire recall window open, which is what recovered $3.6M here.