Skip to content

Lawsuit: Lax cybersecurity let hackers get away with $1.7M

A Boardman manufacturer suffered a "catastrophic" cybersecurity breach in January 2018, according to a new civil suit.
getty stock cybersecurity 640x420
Getty Images

YOUNGSTOWN — A Boardman manufacturer claims a “catastrophic” cybersecurity breach allowed hackers to steal more than $1.7 million.

The company, Boardman Molded Products along Thalia Avenue, is now suing its IT provider, Involta LLC of Cedar Rapids, Iowa, for negligence, malpractice and breach of service. The civil complaint was filed Tuesday in Mahoning County Common Pleas Court.

The manufacturer hired Involta in April 2017 — paying Inearly $11,000 a month, according to an invoice included with the complaint — to set up and manage its private servers, a digital network and cybersecurity measures, among a host of other services.

The following January, the manufacturer noticed its Microsoft Outlook email account had been compromised by “malicious external hackers with criminal intent.”

The hackers reportedly rerouted accountants’ emails, along with spreadsheets and other files. The hackers then created multiple fake invoices with payment instructions. The fake payments totaled $1.7 million, according to the suit.

The suit accuses Involta of not doing enough to protect its digital systems, though it represented its cybersecurity expertise to the company and was hired to manage them, allowing the manufacturer’s own IT personnel to focus on other tasks.

“When the incident was reported to Involta, the ticket received only a ‘medium’ priority rating,” the suit states. “The day after the incident was first reported, Involta insisted that the breach had never taken place and accordingly closed the ticket.

“In fact, Involta had shown an overall relaxed attitude regarding security issues.”

Weeks after the security breach, the manufacturer found foreign data, revealed to be 114 viruses, on the manufacturer’s virtual server, which was within Involta’s own data center, the suit claims.

Involta even claimed the manufacturer’s security rules were too relaxed, though Involta managed the security and the manufacturer’s IT personnel were not permitted to set security rules.

The suit seeks an unspecified amount of damages.

A representative of Boardman Molded Products on Wednesday declined to comment on the suit.

Attorneys for Involta LLC have not yet been named in the case.

The case has been assigned to county Judge Anthony D’Apolito.

Justin Dennis

About the Author: Justin Dennis

Justin Dennis has been on the beat since 2011, covering crime, courts and public education. Dennis grew up in Poland and Salem and studied journalism and communications at Cleveland State University and University of Pittsburgh.
Read more