Three months after cyber bandits hacked White Lake Township stealing about $30 million during the closing of a municipal-bond offering, the community is returning to the market.
The community of 32,000 plans to sell $29 million of bonds after the cyberattack forced it to cancel a debt issue to finance the construction of a civic center.
On the day of the initial sale’s closing in November, criminals impersonated a township official after gaining access to the municipality’s email, according to an offering document for the upcoming sale. The hackers then directed Robert W. Baird & Co., the investment bank that bought the bonds, to wire the purchase price to an account they set up.
About $21.3 million of the funds have been recovered and returned to Baird, according to the document. The investigation by federal authorities and the White Lake Township Police Department is ongoing.
“This requires a threat actor that has a really good and intimate knowledge of the bond sale process in the US,” said Omid Rahmani, a Fitch Ratings analyst and expert in public-sector cyber risk. “This isn’t just a haphazard shotgun attack against the entity hoping you get something. This is something that has a lot of premeditation. You have to get the timing just right for it to work.”
Rahmani said it was the first time in his almost decade-long career that he remembers a municipality disclosing the hijacking of bond proceeds. It likely won’t be the last, he said.
“The thing about cyber crime is that it’s kind of like when you go exploring a new territory. Once you establish a trail-head, then that becomes a way of travel,” he said. “Once you have proof of concept of attack, then others are going to want to mimic that.”
Township supervisor Rik Kowall and Police Chief Dan Keller didn’t return calls seeking seeking comment. A spokesperson for Baird also didn’t reply to requests for comment.
The incident underscores the threat that states and localities face from cyber criminals. Small local governments tend to be understaffed and their information-security employees are often paid less than their private-sector counterparts. Municipalities — stretched by the increasing cost of providing services and paying retiree benefits — also may not have the money to beef up cyber-security investments, leaving them ill-equipped to thwart such attacks.
In recent years, cities, municipal water systems, public schools and public-power providers have been the targets of cyberattacks. Baltimore and Atlanta have fallen victim to offensives that use malicious software to hold a computer system hostage. Those invasions can cost the cities millions of dollars.
Sophisticated cyber-crime groups hire financial analysts and comb local-government financial disclosures to find out how much cash they have on hand, Rahmani said.
Cybercriminals are increasingly using artificial intelligence to attack targets, employing artificial intelligence-powered voice- and video-cloning techniques to impersonate family members, co-workers or business partners, the Federal Bureau of Investigation warned last year. AI increases the speed, scale and automation of attacks, the FBI said.
White Lake Township will use a negotiated sale for its upcoming bond offer, which is to be managed by Stifel Financial Corp. In that kind of transaction, a municipality hires a pool of banks to find buyers, with interest rates set in discussions with those underwriters. A Stifel spokesperson didn’t provide a comment beyond saying the sale isn’t pricing this week.
The community said in December that it was moving forward with the construction of the civic center. The project will include a new town hall and public-safety building to house a police and fire station.
The prior debt issue was sold on Oct. 31 through a competitive bid, where banks bid against each other to purchase the securities at the lowest cost to the issuer. Baird won the sale and was awarded the bonds. On Nov. 21, the day the deal closed, the township learned it had been victimized and notified the police. The bonds were then canceled.
Attorneys for Baird sent a letter to the township in January saying it had suffered at least $6 million to $7 million in losses from the crime and demanded repayment, according to White Lake’s offering document. White Lake said it intends to “vigorously present its defenses.”