SYCAMORE – The FBI is investigating a possible link behind a computer virus and money stolen from Sycamore School District 427, according to law enforcement officials.
Sycamore Schools Superintendent Wayne Riesen said that the district had been hit by a cyberattack in July but could not confirm the exact date of when the thefts occurred or how much money was taken.
Det. Sgt. Steve Cook with the Sycamore Police Department said his office was alerted by the school district on July 16 about the theft, which totals close to $300,000. The district discovered the missing money when going through payroll records, he said. More than one transaction was made over several days, he said.
“Some very astute people in our business office noticed it as it was taking place and informed our assistant superintendent for business, who informed me, and we took appropriate measures at that time,” Riesen said.
The FBI and the district’s legal firm is working on the case, Riesen said.
“From my understanding, this is big,” he added.
“The matter was turned over to the FBI,” Cook said. “They are the lead investigating agency. We are cooperating with the FBI and providing them with assistance as needed.”
Cynthia Yates, a spokeswoman for the Chicago office of the FBI, confirmed that the Sycamore School District and Crystal Lake District 47 are part of their investigation, but declined to identify any other organizations involved in the case.
The virus used against the Crystal Lake District is Clampi, Yates said, but she declined to confirm how it works. She also declined to confirm if the same virus was used in the attack against Sycamore.
Thefts from businesses and other school districts around the nation have been blamed on the virus, according to media reports, which snags computer user names and passwords.
Initially, about $425,000 was reported missing from Crystal Lake District 47, but some of the money was recovered and the unauthorized transactions were stopped, Superintendent Donn Mendoza said.
“It was not stolen in one big chunk, but it was a relatively short period of time, so within a few days,” he said.
No arrests have been made or charges filed in the case yet, Yates added.
“We are investigating this and other similar incidents that have been reported to us,” she said. “Right now, it’s a federal investigation. We are working with counterparts in other FBI offices. It is a coordinated effort throughout the country.”
Sycamore Schools is taking every precaution it can to prevent any similar breaches, Riesen said. The district has liability insurance for the lost of funds, he said, and the money could also be recaptured as the investigation continues.
“It’s unfortunate. It’s a sign of the times in which we live,” Riesen said. “We have unscrupulous people out there who try to steal.”
Representatives for the DeKalb, Genoa-Kingston and Somonauk districts said they have not been victims of any similar cyberattacks.
Messages left with the Hiawatha, Hinckley-Big Rock, Indian Creek and Sandwich school districts were not immediately returned Thursday.
• Brett Rowland of Shaw Suburban Media contributed to this report.