Philly schools lose $700K to cyber fraud

The Philadelphia School District has lost $700,000 to a cyber scam, city and school system officials announced Thursday.

On four separate occasions in the 2023-2024 school year, the district made electronic payments to people posing as its vendors, City Controller Christy Brady said at a news conference. She became aware of the fraud when preparing results of her audit of the district, released last month.

The district paid $563,151 to a scammer in March 2024, intended for flood damage repair at one of its buildings. It also paid $126,056 for compensatory educational services for students with disabilities in February and March of that year.

In both cases, the actual vendors’ emails had been hacked.

No payments were made beyond what was owed to the vendors, officials said. Money came from both the district’s operating and capital budgets, officials said.

“We believe payments were diverted by malicious actors through [electronic transfer] fraud, resulting in the school district’s vendors not receiving the funds,” Brady said.

The payments have not been recovered, officials said.

The scammers appeared to have “gained access to the school district’s banking data or manipulated existing payment systems to send unauthorized funds to their own accounts,” Brady said. (The district typically issues paper checks to all vendors, officials confirmed.)

Brady alerted the Pennsylvania Attorney General’s Office and requested an urgent investigation.

“It is unknown if the fraudulent actors employed tactics that would allow them to embed themselves into the financial workflow or systems, resulting in [electronic payment] fraud incidents in addition to what we have been provided to date,” Brady wrote in a letter to state Attorney General Dave Sunday.

Brady said the district has been fully cooperative, and described the current process as “a joint effort among government agencies, united by a shared goal: to ensure taxpayer dollars are dedicated to meeting educational needs and enriching student experiences.”

She said she could not provide further information, including the vendors or financial institutions involved, but Superintendent Tony B. Watlington, who appeared at the news conference, said that two vendors were involved, and that the fraud was reported to the FBI and the district’s office of inspector general as soon as it was discovered.

Watlington said the district is “absolutely committed to transparency” and noted that the scam happened “in a world that’s become increasingly complex with cyber issues.”

District officials said neither the district’s financial nor student data management systems were compromised.

“To combat cyber fraud, the district has implemented several measures, including revising bank confirmation processes, improving the process to validate payment changes with vendors, and strengthening internal controls,” spokesperson Monique Braxton said in a statement.

Brady said city and district officials are on the same page.

“The public has a right to know how their money is being used,” she said.

City Councilmember Isaiah Thomas, chair of Council’s Education Committee, praised Watlington‘s handling of the situation.

“He’s done his due diligence to make sure the public understands everything that has happened,” Thomas said of the superintendent.

The district has a $4.5 billion budget to educate 115,000 students in 216 traditional public schools and an additional 80,000 in city charters. In recent years, it has received strong marks for its financial stewardship — its credit rating is the highest it has been in decades.

But financial troubles loom; the district is alone in Pennsylvania, unable to raise its own revenues. Instead, it must depend on the city and state for the bulk of its finances.

Brady, whose office is charged with auditing the district regularly, said she valued the district’s cooperation.

“By working together, we will assist the school district in recovering any available funds and implementing safeguards to prevent future fraud,” Brady said.