Cybersecurity experts urges stronger ‘cyber hygiene’ after Cape Fear scams

WILMINGTON, NC (WWAY-TV) – Late last year, two municipalities in the Cape Fear fell victim to cyber attacks losing hundreds of thousands of dollars. A cyber expert at UNCW spoke with WWAY to share why cyber criminals target municipalities.

“Hackers usually go for easy effort whatever is easy to get access to the systems,” said Ulku Clark, cybersecurity and information systems professor at UNCW.

Clark said municipalities like Pender County and Carolina Beach can sometimes become targets because they are seen as low hanging fruit.

“Municipalities usually have low resources when it comes to cybersecurity and when the hackers or attackers identify a target with low resources that makes their job easy,” Clark said.

Pender County lost $650,000 after scammers impersonated the Lower Cape Fear Water and Sewer Authority and request a change to banking details via email. County Manager, Colby Sawyer said the loss was preventable and that protocol wasn’t followed when the scam occurred.

“Were certainly being more suspicious of every email we receive, really trying to focus on the prevention side and we’ve also done some additional training and we will continue to do some additional training,” Sawyer said.

In Carolina Beach, two cyberattacks led to the theft of $488,000. Town Manager, Bruce Oakley said they believe the hack occurred during a period when the town was updating its cybersecurity policies.

“We’ve had audits, penetration tests, and various things over the years, but we do not have a regular program of them so,” Oakley said.

Clark said municipalities can be particularly vulnerable because they often don’t have th necessary budget or staffing to prevent cyber-attacks.

“Having a IT person or having a cyber security person usually having that staff line is not very easy to budget,” Clark said.

Clark said local governments should focus on basic “cyber hygiene” like strong passwords, regular employee training and multi-factor authentication. She said having cyber insurance can also be a critical safety net.

“The cyber insurance is a pretty nice way of making sure that you are on top of things,” Clark said.

Caroline Beach Mayor said they hope to regain a portion of the lost funds through an insurance claim and what isn’t recovered will come out of the town’s general fund. Both cyber-related crimes in Pender County and Caroline Beach are still under investigation.