Lawsuit: Lax cybersecurity let hackers get away with $1.7M

YOUNGSTOWN — A Boardman manufacturer claims a "catastrophic" cybersecurity breach allowed hackers to steal more than $1.7 million.

The company, Boardman Molded Products along Thalia Avenue, is now suing its IT provider, Involta LLC of Cedar Rapids, Iowa, for negligence, malpractice and breach of service. The civil complaint was filed Tuesday in Mahoning County Common Pleas Court.

The manufacturer hired Involta in April 2017 — paying Inearly $11,000 a month, according to an invoice included with the complaint — to set up and manage its private servers, a digital network and cybersecurity measures, among a host of other services.

The following January, the manufacturer noticed its Microsoft Outlook email account had been compromised by "malicious external hackers with criminal intent."

The hackers reportedly rerouted accountants' emails, along with spreadsheets and other files. The hackers then created multiple fake invoices with payment instructions. The fake payments totaled $1.7 million, according to the suit.

The suit accuses Involta of not doing enough to protect its digital systems, though it represented its cybersecurity expertise to the company and was hired to manage them, allowing the manufacturer's own IT personnel to focus on other tasks.

"When the incident was reported to Involta, the ticket received only a 'medium' priority rating," the suit states. "The day after the incident was first reported, Involta insisted that the breach had never taken place and accordingly closed the ticket.

"In fact, Involta had shown an overall relaxed attitude regarding security issues."

Weeks after the security breach, the manufacturer found foreign data, revealed to be 114 viruses, on the manufacturer's virtual server, which was within Involta's own data center, the suit claims.

Involta even claimed the manufacturer's security rules were too relaxed, though Involta managed the security and the manufacturer's IT personnel were not permitted to set security rules.

The suit seeks an unspecified amount of damages.

A representative of Boardman Molded Products on Wednesday declined to comment on the suit.

Attorneys for Involta LLC have not yet been named in the case.

The case has been assigned to county Judge Anthony D'Apolito.

This story was originally published January 23, 2020 at 3:26 AM with the headline "Lawsuit: Lax cybersecurity let hackers get away with $1.7M."