Hackers stole nearly $700K from Philadelphia school district’s banking system in 2024, city controller says

From Philly and the Pa. suburbs to South Jersey and Delaware, what would you like WHYY News to cover? Let us know!

Malicious actors posing as vendors allegedly hacked into the School District of Philadelphia’s banking system several times in 2024 and diverted a total of nearly $700,000 into their own accounts, Christy Brady, city controller, said Thursday.

Brady spoke about the cyberattack at a news conference at her office in the Municipal Services Building on JFK Boulevard. Schools Superintendent Tony Watlington Sr. and City Councilmember-at-Large Isaiah Thomas, chair of the body’s education committee, were among those in attendance.

According to Brady, the discrepancies in the district’s Automated Clearing House, or ACH, system were discovered during an annual audit of the school district’s fiscal year 2024. As part of the audit final review and feedback, the school district informed Brady about the payments.

“We learned of four instances that occurred last year regarding fraudulent ACH payments. On March 12, 2024, an ACH transfer for $563,151 was made for flood damage repair work,” Brady said. “Additionally, on Feb. 6, Feb. 27 and March 8, ACH transfers for payments totaling $126,056 were made for compensatory services.”

The investigation is ongoing, Brady said, adding that the payments have yet to be recovered and the vendors have not yet been paid. The individuals or entities who allegedly committed this cyberattack, along with the two vendors involved — and financial institutions affected — were not identified by Brady or the school district.

The district’s system is set up to pay vendors by paper check unless they request ACH payments, Brady said. In this case, individuals or entities were able to hack into the system and request wire transfers.

She also submitted her findings by letter to Pennsylvania Attorney General David Sunday.

“I want to highlight that this has been a joint effort among governing agencies, united by a shared goal,” Brady said. “To ensure taxpayer dollars are dedicated to meeting educational needs and enriching students’ experiences.”

The controller’s office serves as the chief auditor of the city of Philadelphia and the School District of Philadelphia and is independent of the mayor. It is an elected position.

Both Thomas and Watlington said they are committed to transparency.

“We implemented a number of measures to enhance internal controls in this age of cyber fraud,” Watlington said. No other similar problems have been reported, he said.

In addition, he said the alleged fraud was immediately reported to the FBI and the district’s Office of Inspector General and Office of General Counsel.

For more than a decade before this incident, Watlington said, the district has reported clean audits with no material findings. It recently posted its best credit rating, which is a measure of fiscal health, in about 40 years.

But it comes at a time when the district is bracing for possible cuts in federal spending on education by President Donald Trump’s administration.

“We are also committed in the School District of Philadelphia to a very strong fiscal stewardship under our Board of Education leadership,” Watlington said. “From day one we focused on ensuring that we have financial discipline in our spending and robust controls.”