The town of Arlington, Mass., is getting closer to finishing its new $234-million high school. But the suburban Boston is out of pocket for the uncovered portion of an insurance claim for $440,000 in stolen project payments carried out with emails that impersonated messages sent by members of the project team.

The crime is one of many schemes that have plagued businesses and public agencies in recent years, including companies involved in construction projects.

Town Manager James Feeney reports that the school's crime insurance policy paid out the policy's limit, $100,000.

That still leaves the town with a loss. Information about a deductible that may have been applied to the policy and claim was not immediately available. Neither was the name of the insurer.

The multi-phased high school—already partly occupied and in use—has taken the town over five years to plan and construct. Skanska USA is the project manager and Consigli Construction is the construction manager.

In June, Feeney disclosed in a letter to residents that the town was working with local and federal law enforcement agencies and a specialized consultant after discovering what the insurance industry terms a "business email compromise attack. Feeny said it had been launched from "a well-resourced" overseas organization that diverted four separate payments to the vendor.

Town and project officials had been exchanging emails with the vendor since September 2023, he said. The attackers compromised certain employee email accounts and manipulated inboxes, including deleting emails. The missing money was discovered in February. 

The town, which has a population of 45,000, has since taken steps to beef up its cyber and email security and the project will not be affected, Feeney wrote. Only $3,308 of the stolen funds had been recovered when the crime was first disclosed.