Surrey man turns himself in after stealing $550k from City of Hamilton in “cyber-enabled fraud”

Hamilton police have charged a 32-year-old man from Surrey, British Columbia for allegedly scamming Hamilton’s housing agency in March 2024.

Officers say this attack is not connected to the initial attack on the city’s IT systems that happened just one month earlier.

“This individual is not related to the cyber attack on the City of Hamilton. This is a common spear phishing-type fraud,” says Const. Adam Kimber from Hamilton Police.

READ MORE: City of Hamilton budgets over $52M for 2024 cyberattack response 

In this additional attack, a staff member at a municipal housing affiliate transferred over $550,000 to someone who appeared to be a known contractor asking for vendor payment.

Investigators say the email request for payment seemed legitimate and would not have been out of the ordinary, as manual workarounds were implemented to maintain vendor payments and other essential services during the cyberattack recovery period.

The discrepancy was not noticed until April, when the legitimate vendor reported not receiving payment.

An internal review supported by the City’s Auditor General and an independent forensic accounting firm revealed that the money had been transferred to an account belonging to a man in Surrey, B.C.

“Judicial authorizations were used for seized devices, accounts, user names… things like that, to discover the identity of the accused,” Kimber says.

Police did not provide details of his identity and say he was released on an undertaking on several conditions.

Upon receiving the funds, he quickly dispersed the money across multiple newly-opened bank accounts at multiple financial institutions.

Legal action led to the freezing of one account, which allowed officers to recover approximately $417,000. Despite the recovery, the City has still lost $130,000, in addition to forensic and legal expenses.

Investigators from Hamilton, Surrey and Edmonton were able to identify the suspect through extensive video surveillance, voice recordings and banking records. Officers say he turned himself in to Hamilton Police at Central Station.

READ MORE: Hamilton expects to release 2024 cyber attack update in third-quarter