In October, hackers got away with hundreds of files of county data and posted it on the dark web. This week we learned that someone or perhaps several people in county government approved a wire transfer payment of $2.4 million to a thief posing as a county business partner.
Not $2,400. Not even $24,000. But $2.4 million of taxpayer money.
We’d like to say we’re surprised and asking ourselves how this could happen. But, sadly, we’re not. Though these last two debacles were the result of malicious external attacks, the county has been the victim of its own technology mismanagement all year.
In January, it auctioned off thousands of laptops that had not been wiped of sensitive personal information. In April, the auditor updated the county’s financial management system, which did anything but that, resulting in a chaotic mess of botched and missed payments to employees and vendors. And in May, it implemented a new criminal justice case management system that has led to problems in such basic functions as processing indictments and tracking jail inmates.
It’s imperative the county prioritize hiring a new director of information technology, a post that’s been vacant since July, and dig deep to select someone who is well qualified for this difficult job. And the public deserves a full accounting of not only the October hack, which officials said they thwarted before too much damage was done, but most especially of the fraudulent payment.
Dallas County Administrator Darryl Martin has said that the scam was discovered in mid-November and that the criminal apparently used a “fraudulent business email impersonating one of our partners and engaged in social engineering.” That’s when a cyber criminal uses some sort of trust-abusing ruse to trick someone into handing over money or access to sensitive information.
But so many troubling questions remain. When did this happen? What types of controls, if any, failed here? Martin said “remedial measures” have been taken, but was the money recovered? He said the fraud wasn’t related to the October hack, but how can we be sure? Who or what department in the county got scammed, and who will be held accountable? Why did officials wait so long to tell the public that its wallet was stolen? And when will a new IT director be named?
Martin didn’t return our email asking many of these questions. Commissioners reportedly discussed a security audit of the auditor’s office during executive session on Tuesday, but recessed without comment. They all must be far more transparent in coming days and weeks regarding this embarrassing and costly mistake.
© 2023 The Dallas Morning News. Distributed by Tribune Content Agency, LLC.