Wednesday, January 7, 2009

N.M. Tech Out $165,000 in Cyber Theft

Scott Sandlin ©2009 The Albuquerque Journal

Used by permission

New Mexico Tech lost more than $165,000 to an Internet theft, one of several federal defense contractors targeted in a banking scam that apparently operated out of Kenya.

In all, the FBI and the Defense Criminal Investigative Service have discovered that almost $2 million was either stolen or targeted for diversion from government agencies.

Federal search warrants were obtained in New Mexico in November for certain electronic mail accounts and Internet connections at Sprint Nextel, Hotmail and Yahoo e-mail addresses connected to the diverted funds.

On several occasions in March and April, money was diverted from Tech accounts to an account at Fidelity Investments set up through identity theft, according to an FBI affidavit.

The FBI said that an unauthorized person gained access to Tech's contract Internet Portal accounts and made changes to banking information. The person electronically told the Battle Creek, Mich., agency that maintains a federal contractor database that Tech's Socorro bank was being replaced by a bank in Kansas City, Mo.

"As a result of the change, many payments from federal agencies totaling over $165,000 were diverted from (Tech)," according to the FBI statement.

No one at Tech authorized the change.

Analysis of access logs showed that unauthorized log-ins occurred from Internet addresses that are part of The Onion Router, described in the affidavit as a free and anonymous proxy operating worldwide to mask subscriber locations.

The Kansas City bank revealed that the money was processed on behalf of Fidelity and routed to the account of a man in Indiana who was listed as living in Casper, Wyo.

Agents who interviewed the man found that he had never lived in Wyoming, didn't use the e-mail address associated with the fund transfers and had never done business with Fidelity even though his birth date and Social Security number were used on the account.

Another set of accounts at Fidelity also received deposits intended for Tech. Some of the funds were used to buy stocks of well-known companies.

The man whose birth date and Social Security number were used to set up those accounts had also never owned a Fidelity account and didn't live in Minnesota, the address listed for him.

FBI analysis of the accounts found that they had been accessed from Internet Portal addresses in Kenya.

Tech spokesman Tom Guengerich confirmed Wednesday that "some outside party diverted money so it never appeared in our account."

Guengerich said that he didn't know the exact amount but that the account raided was that of the Energetic Materials and Research Testing Center.

"It's under investigation by FBI," he said. "We hope we'll be able to get it back."

The FBI Cyber Crimes investigation found other victims of the same scam, including the University of Western Florida.

As with Tech, access was gained from the anonymous router, and the stolen money was used to buy stock in large corporations.

The FBI investigation traced two of the bogus accounts to the same IP address in Nairobi, Kenya.

More than $10,000 was diverted from the Research Foundation of the State University of New York in May, and more than $167,000 being transferred from government agencies to the University of Notre Dame was deposited to an individual account on June 3, the affidavit says.

Similar incidents involving other contractors and universities whose banking information was altered to divert funds occurred between March and July, according to the affidavits.

E-mail this story Printer-friendly version