Are public school districts adequately securing accounts?
How many school districts have had their funds hacked or otherwise illegally transferred to non-district accounts that we may never have heard about? Consider this newly released NYS Office of the Comptroller audit of Lindenhurst School District on Long Island that reports what were likely hacked accounts in 2007:
There are nine schools in operation within the District, with approximately 7,000 students and 1,500 employees. The District’s budgeted expenditures for the 2007-08 fiscal year were $127 million, which were funded primarily with State aid, real property taxes, and grants.
During July 2007, six unauthorized on-line wire transfers amounting to $601,577 were initiated that improperly transmitted money from a general fund bank account to various non-District accounts in other banks. In August 2009, we referred this matter to the Suffolk County District Attorney’s Office for further investigation. The Suffolk County District Attorney’s Office investigated this matter and found no evidence of criminal activity by District officials or employees.
The objective of our audit was to determine if the District’s internal controls over selected financial operations are appropriately designed and operating effectively for the period July 1, 2007, to June 30, 2008.[….]
In July 2007, someone improperly transferred approximately $600,000 from a District bank account to various external bank accounts. Officers at the depository bank recognized the inappropriate nature of these transactions and took action to recover the funds. However, they were only able to recover $496,590. The District lost nearly $105,000.1 We found that the Board and District officials never investigated and determined how the unauthorized on-line wire transfers were enacted, and never informed law enforcement officials of this significant theft, because they were reportedly told that the bank had notified the Federal Bureau of Investigations. Although controls over on-line wire transfers were improved, the controls over wire transfers initiated by telephone and fax continue to be poor; therefore, the District is still susceptible to the loss of cash through unauthorized transfers.[…]
1 The loss was reported to the District’s insurance company. In May 2008, the District received a check for $102,487 from their insurance company and $2,500 from the bank, which was the full amount of the loss.