A prominent real estate firm known for its luxury properties reportedly fell victim to a phishing scam that resulted in the loss of nearly $19 million.
Milford Entities/Management Company, which manages properties like the Liberty View and Liberty Luxe in Battery Park City, was targeted by cybercriminals back in early July, as revealed by various sources and internal emails.
The fraudulent email, described as “spoofing,” tricked the company into transferring a significant sum to a TD bank account impersonating the Battery Park City Authority, according to insiders and internal communications.
The Department of Homeland Security is currently leading a proactive task force to investigate this fraud, based on information obtained by the Post Office.
In a statement, Milford management acknowledged that they were defrauded last month, detailing how funds were stolen through the creation of fake bank accounts under the name of the Battery Park City Authority.
The management further stated that the theft involved properties directly owned and managed by the company.
They added that there would be no additional comments since the situation is under active law enforcement inquiry.
The Battery Park City Authority (BPCA), a state entity responsible for managing the Manhattan waterfront, confirmed earlier this month that it would not receive the quarterly payments from Milford’s properties.
The missing funds were intended for ground lease payments and taxes, typically paid by the owner of the Battery Park City apartments to the BPCA on a quarterly basis.
Milford Entity manages three buildings in Battery Park City, overseeing at least six staff members in this bustling downtown area and collecting payments from over 2,000 residential units.
Following this incident, the management of one of Milford’s luxury residential towers reported on July 18 that $3.5 million of their quarterly fees were lost due to the fraud.
The BPC Homeowners Coalition, which consists of 18 condominium buildings and represents about 5,000 homeowners, sent out a warning email urging residents of unaffected buildings to review their cybersecurity measures.
In the email, they stated, “While this seems to be the first cyberattack on Battery Park City, it likely won’t be the last.” They emphasized the importance of communication among condo boards, suggesting that this kind of incident could potentially target any building management entity.
The BPCA acknowledged awareness of a cyber incident causing payment issues affecting multiple buildings in Battery Park City. However, they clarified, “The BPCA is not involved in this incident, and its operations remain unaffected.” They will be cooperating with the impacted properties and law enforcement as the investigation unfolds.
As of now, the DHS has yet to respond to any requests for comments regarding the ongoing situation.
