Water and fire district sues LI bank over $15M cyber theft

Listen to this article

The Garden City Park Water/Fire District filed suit in New York State Supreme Court Wednesday against First National Bank of Long Island for allowing the theft of more than $15 million in funds from the district’s accounts. 

The lawsuit stems from a July 2024 cyber-crime in which hackers impersonated district personnel and convinced the bank to make unauthorized changes to the district’s account settings, including allowing online international and domestic wire transfers, services never previously requested or used by the district, according to the complaint. The cybercriminals also convinced the bank to provide them with confidential login information, or the means to create such information, that then enabled them to access the district’s bank accounts to initiate wire transfers. 

The next day, the cybercriminals logged into district bank accounts and authorized 15 wire transfers totaling more than $15 million, including more than $12 million sent to banks in China within four hours, according to the complaint. The lawsuit claims that despite numerous irregularities and red flags, including exceeding the bank’s own limits on wire transfers by customers, the bank processed each of the unauthorized transfers.

“As the complaint outlines, First National Bank of Long Island’s failures allowed cybercriminals to steal more than $15 million from the district,” the Garden City Park Water/Fire District commissioners said in a statement. “As fiscally responsible stewards, we are undertaking this legal action because the district should not suffer for the bank’s failures and incompetence. We will continue to do everything possible to fight for our residents and hold responsible parties accountable. Because we are now in a legal process, we will refer all future comments to counsel.” 

A statement issued by the bank said it became aware of suspicious wire transfer activity involving a customer’s bank accounts last summer and the incident was reported by The First of Long Island Corporation, the bank’s parent, in an 8-K filing filed August 28, 2024. 

“When the bank became aware of the issue, it immediately began working with law enforcement to recover funds for the customer and undertook an investigation with the assistance of a digital forensic investigations firm,” the statement read. “The bank has successfully recovered for the customer a substantial amount of the customer’s funds, and is continuing to seek additional recoveries. The bank’s investigation did not yield evidence of unauthorized bank network activity. Further, the bank believes that it followed its reasonable procedures regarding online wire transfers…the bank intends to continue to work to recover customer funds, while defending itself in the lawsuit, and remains committed to ensuring a full recovery of all customer funds.” 

Though law enforcement assisted in recovering $4.4 million of the stolen funds, the lawsuit is seeking about $11 million still outstanding, as well as court costs and punitive damages. 

“What happened to the district is every bank customer’s nightmare,” attorney Jon Ward, co-managing member of Sahn Ward Braff Coschignano, who is representing the district in the lawsuit, said in the statement. “The district relied on their bank to protect the security and integrity of its deposits, and First National Bank of Long Island failed. Now, we are asking the court to hold First National Bank of Long Island accountable for its failure.” 

In a message sent to residents in the Garden City Park Water and Fire District, officials said the theft has not impacted the district’s operating funds or impeded its work and residents’ personal information was not compromised. 

The district does not anticipate increases in taxes as a direct result of the fraud, since the stolen funds were in an account for prospective capital projects, according to the statement.