A screen shot from the YouTube video of the Oct. 18 meeting of the Seymour Board of Selectpersons.
SEYMOUR — The Seymour Police Department and the FBI are investigating a cybercrime that swindled town government out of $375,000, The Valley Independent Sentinel has learned.
“The Town of Seymour is victim to a cybercrime perpetuated by an unknown party,” according to a statement from Seymour First Selectwoman Annmarie Drugonis and Seymour Town Attorney Richard Buturla. “The Office of the First Selectwoman ordered an immediate investigation into how this fraud occurred. In addition, the Seymour Police Department was instructed to immediately initiate a criminal investigation into this matter.”
The statement was issued after The Valley Indy started asking questions about the matter.
The Valley Indy previously reported that town officials met with Seymour Police Chief John Bucherati and Buturla during an executive session on Oct. 18 “to discuss an attorney-client privileged communication,” according to a meeting agenda.
The crime was the subject of that discussion. Drugonis said an investigation began shortly thereafter.
“As soon as we found out about it, we immediately got the police involved, the town attorney and the FBI because it’s cyber security. Any time there’s a cyber attack on a municipality, the FBI gets involved,” Drugonis said on Monday.
Town officials didn’t detail the crime. It apparently originated from an email phishing scheme and ended with town funds being transferred to a scammer.
The scam involved both the school district and town government.
Chief Bucherati confirmed that a criminal investigation is underway.
“Any information released can jeopardize the case,” Bucherati said.
The town has also contacted its insurance company in an effort to recoup funds.
The most recent combined school and town budgets for Seymour totaled $62.3 million. A loss of $375,000 is comparable to the town’s library budget of $373,000.
Seymour school district business manager Salvatore Bucci did not return a phone call seeking comment. Chris Champagne, the chairman of the Seymour Board of Education, said he was not aware of the police investigation.
“I can’t say anything, but once the investigation is over, you will get the details,” Seymour Finance Director Doug Thomas told the Valley Indy.
Cyber attacks, such as ransomware targeting municipalities, have been on the rise for a decade.
The Vermont League of Cities and Towns issued an alert in 2020 warning local governments specifically about scams originating from emails.
“In this scenario, the criminal scams an employee into willingly transferring funds or information in a transaction that the employee honestly believes is legitimate,” according to the bulletin posted to the group’s website.
The bulletin describes two common email scams targeting local governments.
In the first scenario, the scammer could research what contracts a given town has awarded, and then learns the name of vendors doing business with the town. Then the scammer will create a fake email address that appears to be from the vendor, and request payment from the town.
“Typically, the criminals target an employee who has the authority to transfer or issue funds, then pretend to be a vendor or contractor by “spoofing” the email address of a trusted vendor – making a subtle change that can go unnoticed by the recipient,” according to the bulletin.
Another variation of the scheme involves the scammer getting money by “impersonating a co-worker or senior municipal official.”
“For example, a person in finance may receive an email request from a criminal posing as a municipal manager, finance director, selectboard member, or other senior official who requests payroll and identification information on employees or demands prompt payment of a “vendor invoice.” The message often has a tone of urgency,” according to the bulletin.
The statement issued to The Valley Indy on Monday.
