WAPA Responds To Outcry, Says It Fell Victim To Phishing Email Resulting In Theft Of More Than $2 Million

The Virgin Islands Water and Power Authority Friday afternoon issued a statement addressing an outcry from the Virgin Islands community, after it was revealed during a Wednesday Senate session that $2.3 million of missing WAPA funds was sent to an offshore account.

During the session, Senator Kenneth Gittens was questioning WAPA Executive Director and CEO Lawrence Kupfer about a major financial loss at W.A.P.A., when some disturbing information came to light. WAPA executives confirmed that $2.3 million of WAPA funds had been wired to an offshore account and that the Federal Bureau of Investigation (F.B.I.) had been notified and was investigating. 

Mr. Gittens acknowledged that while the legislative body and testifiers were there to discuss another issue, “Pandora’s box had been opened.” He asked W.A.P.A. officials to expound on the matter, and the authority’s general counsel, Lorelei Farrington, explained to Mr. Gittens that the incident had been reported to the F.B.I. and there was indeed an ongoing investigation.

“Approximately $2.3 million sent to an offshore account that we cannot account for?” Mr. Gittens asked incredulously. “It was reported to the authorities and is being actively investigated?” he asked. Ms. Farrington confirmed it yet again. 

In its statement today, WAPA said it had fallen victim to what is referred to as a Business Email Compromise (BEC), an instance where a fictitious email appears authentic. These incidents, WAPA said, resulted in payments totaling $2.17 million being authorized and sent to an apparent legitimate vendor — but the vendor was not legitimate at all; it was a scam, said the authority.

WAPA said since the incidents it has provided overall cybersecurity training for its staff, as well as training on recognizing phishing emails that can lead to such BEC scams. The authority said it also revised its financial control procedures. “The training is recurring, and we use controlled phishing emails to test our employees ability to determine authentic from bogus emails,” Mr. Kupfer said in today’s release.

Asked by The Consortium why wasn’t the public informed of this matter earlier, Jean Greaux, director of corporate communications at WAPA, said he could not comment on anything outside of the release.

“While we can say very little until the federal investigation into the incidents is complete, I thought it prudent, in light of the Senate discussion this week, to reassure the community that while WAPA was victimized by the BEC incidents, we have taken all advisable security measures to ensure an incident of this nature does not recur. Equally as important, WAPA’s networks, customer information, computer systems, or its overall digital infrastructure were not compromised,” Mr. Kupfer added.

Relative to what WAPA is now saying was $2.17 million sent to an offshore account via a BEC scam, a lot of unanswered questions remain. For example, WAPA said the payments which totaled more than $2 million were sent to the offshore account twice in 2018, the first in May and the second in June. But if a vendor is expecting a payment of, say hundreds of thousands or a million dollars, and does not receive said payment, why would the vendor allow an entire month to pass without notifying WAPA? WAPA said it only caught on to the apparent scam following the second payment in June, at which point, it said, the FBI was notified. The authority refused to comment further, again citing the ongoing investigation.

Senator Kenneth Gittens expressed frustration on his Facebook page, a social medium he uses to keep his constituents informed. “It is now a full year since these transactions took place and we have very little information. I am urging WAPA to aggressively pursue the return of these funds and work to see that such a thing does not occur again. This is a serious matter. We must take all steps necessary to eliminate waste, fraud and abuse of our resources,” the senator said.

WAPA has been under immense pressure as of late. Along with the issue of the missing millions of dollars, the authority was sued by two current employees who levied damning accusations on the semiautonomous entity, contending that WAPA has lied to the Public Services Commission (PSC); it has taken retaliatory action against whistleblowers; and has made bad decisions that caused costs to increase 20-40 percent annually. On top of the aforementioned, WAPA is facing ultimatums from vendors, including propane supplier Vitol, a firm the authority owes tens of millions of dollars.