CSIDB logo
Incident

Spotsylvania County

Incident posture

Attack window
Jul 2019
Location
United States of America
Status
Historical
CIA posture
Available to members
Updated
2025-11-03 00:00

Linked entities

Victim
Spotsylvania County
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
Jul 2019
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

A phishing attack targeted Spotsylvania County, resulting in the theft of over $600,000. Law enforcement agencies, including Virginia State Police and local authorities, collaborated with out-of-state partners to trace fraudulent deposits across multiple banks, recovering $347,010.39 initially with additional funds expected shortly after. The investigation remained active, involving several individuals linked to the scam, though no arrests or charges had been filed at that time.

Motives

Detailed motive labels are available to members.

1 motive

TTPs

Detailed technique labels are available to members.

1 technique

Description

In July 2019, Spotsylvania County fell victim to a phishing scam that resulted in the theft of more than $600,000 from county funds. The incident was publicly disclosed on August 15, 2019, when Virginia State Police announced partial recovery of the stolen money. Law enforcement agencies, including Virginia State Police and local police, collaborated with counterparts in other states to trace fraudulent deposits made to accounts at multiple financial institutions. The investigation remained active at the time of reporting, with authorities pursuing several individuals connected to the scheme. No arrests or criminal charges had been filed by mid-August 2019, as investigators continued working to identify all responsible parties.

On August 15, 2019, Virginia State Police Sgt. Brent Coffey confirmed the recovery of $347,010.39 through coordinated interstate efforts. Authorities physically delivered checks for this amount to Spotsylvania County that day, with additional recovered funds scheduled for handover the following week. The phishing attack's operational specifics weren't disclosed, though the recovery process involved tracking illicit transactions across banking networks in multiple jurisdictions. Financial impacts to the county were partially mitigated through these recoveries, though the initial loss significantly exceeded $600,000 before restitution. Law enforcement maintained an open investigation focused on identifying perpetrators and recovering remaining stolen funds through continued interagency collaboration.

Sources

Sources available to members: 1 source.

CSIDB