Email hack led to $13 million theft scheme targeting Chester-Upland school district, DA says

CHESTER, Pennsylvania (WPVI) -- A Delaware County school district was the target of an elaborate online theft scheme.

Authorities say hackers used an email hack to steal more than $13 million in state funding. More than $10 million has been recovered, but those responsible are still out there.

At a news conference Friday, Pennsylvania Treasurer Stacy Garrity and Delaware County District Attorney Jack Stollsteimer revealed how hackers were able to compromise the Chester Upland School District email system.

"Different payments, electronic payments, were diverted. They were actually intercepted because some thief or thieves had penetrated the school district's email system and had been able to send emails that were official looking because they were from the school district's email account," said Stollsteimer.

He says the scammers, believed to be from Nigeria, used that email account to request a change in payment so the money from the state would go to the overseas account, instead of the district's bank account.

The investigation revealed the thieves then used dating website E-Harmony to scam a widowed, Florida woman into funneling money for them.

"She believed that she was helping someone that she was falling in love with, who she had never met," said Stollsteimer.

The scheme all came to a halt in February when the Treasury flagged the payment request and was able to recover $10 million.

"Because the transaction was so large, $8.5 million, we decided to do some investigative work of our own. We put a hold on it and went back in history and saw there was sort of an account change," said Garrity.

"If the treasury had not stopped that last payment, teachers might not have been paid their last paycheck," said Stollsteimer.

Three million dollars are still lost - money that the students desperately needed.

"Why would people attack school districts? They're already hurting for money, they're already hurting for resources," said parent Mary Jezior.

The DA says it's up to the insurance carrier and PDE to determine if they can recoup that $3 million for the district.

The Department of Treasury has now added another layer of fraud protection in place so this doesn't happen again.