CT city notifies hundreds that personal information could have been compromised in cyber attack

"Unfortunately, we live in a world where there are bad actors who seek to prey upon and steal from innocent people," the mayor said.

Officials are notifying more than 400 people that their personal information could have been compromised during a cyber attack that led to the city’s Board of Education being defrauded out of nearly $6 million last year.

The cyber attack in New Haven in June 2023 led to a management member for the board mistakenly paying $5.9 million to what was believed to be a school bus company contracted with the city, which turned out to be hackers who had mimicked the bus company through a fake email address.

About $5.1 million of the funds have been recovered.

New Haven officials this week said they have since learned that personal information belonging to individuals may have been compromised during the cyber attack.

“Upon discovering this activity, the city began an internal investigation and engaged a forensic investigation firm to investigate,” officials said in a statement. “The forensic investigation found unauthorized access to city email accounts containing personal information from June 1, 2023 through June 18, 2023.”

“The City then engaged an e-discovery firm to search the email accounts for any personal information that could have been viewed during the period of unauthorized access,” officials said.

“The city’s investigation subsequently determined that personal information belonging to 404 individuals could have been accessed. These individuals include city employees, retirees, vendors, and others. The accessible information varied by individual, but included names, dates of birth, social security numbers, driver’s license numbers, financial account numbers, individual tax identification numbers, health insurance information, and/or medical information.”

According to New Haven officials, letters are being mailed to 334 individuals whose contact information was available. Officials have posted a notice on the city’s website in an effort to reach the other 70 individuals whose information was not readily available.

“At this point, the city is not aware of any fraud or identity theft to any individual as a result of this incident, but nonetheless is notifying potentially involved individuals to provide them with more information and resources,” city officials said. “The notice includes information on steps individuals can take to protect themselves against potential fraud as well as complimentary one-year membership to an identity protection and credit monitoring services firm.”

Anyone who believes they have been impacted can call 888-326-0947 Monday through Friday from 9 a.m. to 9 p.m.

Anyone who finds any suspicious activity has been encouraged to notify the entity with which the account is maintained and report any possible fraud to law enforcement.

“The intent of these criminals was to steal money from New Haven Public School students,” Mayor Justin Elicker said in a statement. “Fortunately, with the help of our law enforcement partners, we’ve been able to recover most of those funds. However, during this cyberattack, these criminals also had the potential to access personal information of individuals.”

“Thankfully, the city is not aware of any identify theft or fraud stemming from this exposure of information. Out of an abundance of caution we want to notify the individuals involved to ensure they are aware and can take the necessary steps to protect themselves and their information,” Elicker said. “Unfortunately, we live in a world where there are bad actors who seek to prey upon and steal from innocent people. We have taken many steps to strengthen our systems since this incident and will continue to improve our systems to help reduce the likelihood of an incident like this happening again.”