On March 18, 2010, Town of Poughkeepsie Supervisor Pat Myers announced the $378,470 diverted by cyber theft from the Town’s accounts at TD Bank had been “restored”. TD Bank, Town officials, nor investigating authorities disclosed the source of the “restored” accounts.

Since TD Bank “restored” the funds to the hacked accounts and has control of all the pertinent facts, the bank should disclose the source of the funds. And although it may not be relevant to Town taxpayers whether TD Bank recovered the “restored” funds or simply paid up, this information is relevant to other commercial banking customers in determining whether their accounts will be “restored” under a similar policy. 

A reasonable person would have thought TD Bank would have questioned the 12 unauthorized attacks on the Town’s accounts when the depositories were in the Ukraine and that, under those circumstances, TD Bank would have immediately made their depositor whole. But TD Bank was not forthcoming with any information until Supervisor Myers called upon them publicly to do so.

In a similar case PlainsCapital Bank declined to refund unrecovered money and instead sued the depositor in the US District Court for the Eastern District of Texas. (See PlainsCapital Bank v. Hillary Machinery, Inc., Case 4:09-cv-00653-MHS-ALM). The Bank asked the court to certify that its security procedures were "commercially reasonable”, that the wire transfer orders were accepted in good faith, and that the bank had not breached its agreement with the victimized depositor.

TD Bank could have chosen to litigate the question of law. But the other side had questionable issues of fact, 44,000 potentially angry constituents and possible depositors of the Town, and Supervisor Myers, who worked tirelessly for the return of taxpayers’ money without a law suit. Pat Myers deserves recognition for her efforts.

In the end, TD Bank wanted to maintain its reputation and good community relations and the Town wanted its money back. The Town got the money back but unless TD Bank makes full disclosure they may not enjoy continued good relations with the community.

For more go to Texas Bank Sues Customer Hit by $800,000 Cyber Heist — Krebs on Security.

To see all comments on this thread please visit:

http://www.krebsonsecurity.com/2010/01/texas-bank-sues-customer-hit-by-800000-cyber-heist/#comments

Gary Levine, Chair-