Selectmen on April 10 finally got to the bottom of the 2011 cyber-hacking incident that resulted in the theft of $134,000 from an Old Rochester Regional bank account.
On February 9, 2011, UniBank alerted school administration to several suspicious money transfers, including a $4,000 deposit to someone in Nashville, Tennessee. By the end of the day, there were 20 electronic transfers of ORR funds to 20 different accounts by the time UniBank froze the ORR payroll account that had been compromised.
Superintendent Doug White, reading from a prepared statement, said bank representatives came to the school and tested the computer system on February 10 and traced the breach to a single computer in the business office. The computer was infected with malware that allowed a remote keystroke logger to record every keystroke made on the keyboard, thus allowing the hacker to acquire passwords and other sensitive information.
White said $100,992.39 was recouped within two months of the incident, but $33,774.61 was never recovered. The insurance company denied the district’s claim for the loss because the incident involved a third-party and not an ORR faculty worker, and UniBank’s investigation found the bank was not at fault for the breach.
Mattapoisett Town Administrator Michael Gagne addressed allegations that $600,000 was the actual amount stolen, and he questioned White about the discrepancy, which Gagne said he heard from White himself when the rumor of a cyber attack began circulating.
“When you called me back that morning … did you not say to me at that time that it was $600,000?” Gagne asked White.
“I could have,” replied White. “I didn’t go to the file.” He said he did call Gagne back right away after going through the file for further information.
“But you do remember saying $600,000?” said Gagne.
White replied, “I potentially could have.” He said that once he went to the file, though, he realized it was $134,000.
When asked if the School Committee could ever recover the remaining stolen funds, ORR Attorney Josh Coleman stated, “To be honest, I think it would be unlikely … The bank didn’t find any fault of their own.”
Mattapoisett Selectman Paul Silva suggested appointing a committee to handle these kinds of situations in the future to quickly assess and disperse information to the three towns so that if there is ever another cyber-hacking, the three towns could monitor their own computer systems.
The selectmen adopted the motion, and the School Committee reluctantly took a vote to also appoint a committee.
Rochester Selectman Richard Nunes criticized what he considered the School Committee’s proclivity for discussing matters in executive session instead of being open with the three towns.
“There was no attempt to hide anything,” said former School Committee Chairman Dr. Peter Bangs, who chaired the committee at the time of the cyber-theft. He said executive session was warranted because public disclosure would have compromised the ongoing criminal investigation.
Current School Committee Chairman Jim O’ Brien said law enforcement advised the committee to keep quiet, but stated that if he were chairman at the time, he probably would have asked more questions.
O’ Brien got defensive when he alluded to one Rochester selectman who ran a letter to the editor in several local publications after Rochester selectmen and the ORR School Committee met in executive session on March 17 to discuss the cyber-theft. O’ Brien said Nunes disclosed “many facts that went on during that meeting” in his editorial. O’ Brien criticized those who “pack up their sand toys whenever they’re not satisfied then run to the [press].”
“There was no conspiracy,” said O’ Brien. “But I will admit, if I had to do it over, I would have certainly met in executive session … with all three towns.”
But third-party incidents not involving personnel do not qualify for executive session, stated Mattapoisett Selectman Jordan Collyer.
Nunes defended the letter he published, saying. “My comments did not reflect anything I said during executive session … so don’t try and paint me as blabbing an executive session to the papers.”
Nunes continued, “I’m tired of the School Committee running into executive session at the drop of a hat.” He said executive session has become “the rule and not the exception” for the committee. “It shouldn’t have to be like that.”
Selectmen asked the School Committee why they do not record their meetings with ORCTV like the rest of the boards and committees do. The question went unanswered.
Discussion got heated after selectmen emphasized that the $34,000 recovered was “no chump change,” expressing disappointment that the committee’s legal counsel did not formally request the return of the money from the bank.
“I believe we’ve taken every step possible … we feel we could to recover that money,” said White.
“It could have been a lot worse,” said Collyer. “With every negative there is a positive … and we shouldn’t discount that.”
Selectmen asked White and the committee to work with their attorney to “put something together” and try to recover the $34,000 from the bank.
Also during the meeting, selectmen discussed the cable television license renewal, voting to keep Attorney William Solomon for negotiations, despite Mattapoisett’s penchant for an attorney from Kopelman and Paige. The vote was 5-1 in favor of Solomon, with Silva abstaining.
The next scheduled joint meeting of the Tri-Town Selectmen is scheduled for June 19 at 7:00 pm at ORR.
By Jean Perry
