Hackers stole $650k and got away, showing limits to law enforcement’s reach
Just before Christmas 2020, hackers began to steal from One Treasure Island, a nonprofit that is redeveloping its namesake island in San Francisco Bay as a haven for low-income and formerly homeless people. Sherry Williams, One Treasure Island's executive director, discovered something was wrong on Jan. 27, when she spoke by Zoom with the intended loan recipient, who hadn't received the first installment as planned. Hackers broke into the email system of the nonprofit's third-party bookkeeper, then inserted themselves into existing email chains by using similar email addresses to pretend to be people associated with the nonprofit. After the hackers infiltrated the bookkeeper's email system, they posed as Ms. Williams in an email to an employee of the member organization that was expecting the loan. Then the hackers took a legitimate invoice that the member organization had emailed to Ms. Williams and sent it to her again, changing the accompanying wire-transfer instructions to a bank in Odessa, Texas, from a California bank. The hackers sent two fake invoices to Ms. Williams, who transferred the $650,000 to the Odessa bank in three increments, for the legitimate invoice and the two made-up ones. Doree Friedman, president of One Treasure Island's board, was hoping the nonprofit would get help.