The Mobile Housing Board of Commissioners (MHB) dealt with a cybersecurity breach earlier this year, a city spokesman has confirmed.
The breach involved a “senior staff member” and a “significant financial transaction,” George Talbot said in a phone interview Monday, Sept. 17.
“The mayor was made aware of the breach,” Talbot said. “He engaged with the leadership of the organization, but determined it was a matter for the board to resolve.”
Sources with knowledge of the situation said the email of former MHB Chief Financial Officer Lori Shackelford was hacked in early spring. Hackers apparently intercepted emails between Shackelford and a contractor tasked with the demolition of Roger Williams Homes, the sources said. The hackers then used that information to send Shackelford an email requesting payment of $485,000. Sources confirmed the amount was mistakenly paid to the hackers.
Shackelford, who retired earlier this summer, could not be reached for comment for this story. Calls to a phone number believed to be hers were not returned by press time. Shackelford did not respond to a Facebook message seeking comment.
Shackelford, a longtime employee of the board, took over as interim executive director in early 2017 when former Executive Director Dwayne Vaughn resigned. She stayed in the position until Akinola Popoola was hired to replace Vaughn late last year.
Although sources have told Lagniappe the FBI is working the case, it’s unclear if an investigation is ongoing. A spokesman for the United States Department of Housing and Urban Development declined to comment on the issue.
Such attacks are not unique to MHB. In February 2017, a number of employees at the Alabama State Port Authority had their tax information compromised due to a spear-phishing attack. The attack targeted an ASPA employee who had access to employees’ W-2 information, according to a previous Lagniappe report.
The FBI defines spear phishing as a method of cyberattack using doctored emails that appear to be from a trusted source in an attempt to obtain otherwise protected or personal information.