Riverhead Town investigating ’email intrusion’

The Town of Riverhead is investigating an email hack of a top-level town employee today.

An intruder “infiltrated” the employee’s email address and “sent an email containing a ‘compromised’ DropBox link to approximately 800 email recipients,” the supervisor’s office said in a press release late this afternoon.

The town’s information technology department was notified of the intrusion at about 1 p.m. today, according to the release.” IT staff successfully deactivated the link and immediately notified all 800 recipients to not open the email,” the release said.

The supervisor’s office said “it does not appear the email intrusion permeated any other aspect of the Town’s network.”

The press release did not identify the employee whose email was infiltrated, but RiverheadLOCAL staff members received emails from the town’s Economic Development, Planning and Community Development Director Dawn Thomas between 12:30 and 12:40 this afternoon. The messages came from Thomas’ Town of Riverhead email address with the subject line “Dawn Thomas shared ‘Town of Riverhead Shared Doc’ with you.” The email said “Here’s the document that Dawn Thomas shared with you.” It contained a link button labeled “Open.” The link led to a SharePoint url. SharePoint is a web application platform that is part of Microsoft 365, a subscription service that includes productivity apps, AI-powered features, cloud storage, and updates, according to software provider.

A subsequent email from the town’s IT director warned not to open the email from Thomas.

Hubbard told RiverheadLOCAL this afternoon there had been no disruption to townwide services and no other town email addresses had been affected.

The Federal Bureau of Investigation says email spoofing and phishing scams are a type of business email compromise scam, “one of the most financially damaging online crimes.”

In a BEC scam—also known as email account compromise — criminals send an email message that appears to come from a known source making a legitimate request. The emails are designed to trick people into giving information to criminals that they shouldn’t have access to. The FBI provides information about these crimes and how to protect yourself from falling victim to them on its website.

The FBI runs the Internet Crime Complaint Center, an online hub for reporting cyber-enabled crime. The site includes access to a complaint form that can be filled out and submitted online.