Eagle Mountain City

Summary

Eagle Mountain City suffered a cybercrime involving email impersonation where attackers infiltrated a legitimate email exchange with a vendor, resulting in a fraudulent Automated Clearing House transfer of approximately $1.13 million. The incident was identified as a cyberattack weeks after the unauthorized transaction, prompting the city to strengthen financial controls for ACH payments while confirming no employee misconduct or compromise of resident or vendor data. An existing cyber insurance policy is expected to facilitate full reimbursement, ensuring no taxpayer burden or disruption to ongoing infrastructure projects despite the financial loss.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 15, 2022, Eagle Mountain City, Utah, became the target of a cybercrime involving email impersonation, though the incident was not confirmed as criminal activity until August 31. Attackers infiltrated an ongoing email exchange between the city and a legitimate vendor, inserting themselves into the communication thread to facilitate fraudulent financial transactions. The exact method of this email compromise remained under investigation at the time of reporting. Through this scheme, the perpetrators successfully initiated an Automated Clearing House (ACH) transfer that diverted approximately $1.13 million in city funds. Officials emphasized that ACH transactions were standard practice for municipal vendor payments, with transfers of comparable size occurring regularly, which contributed to the delayed detection of the fraudulent activity.

The financial loss represented a direct impact on city resources, though officials clarified the annual $110 million budget and an ongoing infrastructure project linked to the transaction remained unaffected. No resident, client, or vendor personal data was accessed or exposed during the breach. Eagle Mountain City responded by dedicating significant effort to revising financial protocols, specifically enhancing safeguards around ACH payment authorizations. The city leveraged a pre-existing cyber insurance policy to pursue full reimbursement, expressing confidence that taxpayer funds would be restored without operational disruption. No internal personnel or vendor employees were implicated in the scheme, with the investigation focusing exclusively on external threat actors. Communications manager Tyler Maffitt publicly outlined these response measures while acknowledging the ongoing nature of the forensic examination into the attack’s technical execution.

Sources

Sources available to members: 2 sources.