Fake vendor email cost East Bay city of Pittsburg nearly $1M

An East Bay city was recently targeted in a phishing scheme that resulted in a loss of nearly $1 million, officials said.

Read more Detectives recover car after baby found dead by Monterey road

The attack, allegedly orchestrated by someone in Nigeria, occurred in February and involved an unauthorized payment of $913,839.81, Sara Bellfronte, the assistant to the city manager, said in a statement Wednesday. The single payment was made when a fraudulent account impersonated a city vendor. 

Officials noticed the payment on Feb. 12 and reported it to the Pittsburg Police Department, who informed county and federal investigators, Bay City News Service reported. The city has been able to recover $696,241 of the funds, but there are still pending insurance claims for the rest of the money, Bellfronte said. 

Phil Galer, the Pittsburg police chief, said in the news release that city officials froze the account that electronically wired the funds when they realized the payment was fraudulent,. 

“Given the nature of this cybercrime, we contacted related agencies and the FBI to tap all available resources,” Galer said. 

Investigators have conducted 18 search warrants for 116 accounts tied to major tech companies, financial institutions and telecommunications companies, Bay City News Service reported. According to outlet, the city said evidence shows that the primary suspect is in Nigeria and there are at least two “criminally affiliated” U.S. suspects. 

Read more Man drowns at Sequoia National Park

The city did not respond to SFGATE’s questions about whether any suspects have been identified or how they allegedly carried out the scheme. 

In the city’s news release, Pittsburg Mayor Dionne Adams called the phishing attack “upsetting” and a “hard lesson” for city officials on how to ramp up their security. City officials are working on improving the city’s cybersecurity, and the FBI and U.S. Attorney’s Office are continuing to investigate the case.

Pittsburg is not the only city in the Bay Area or California to be targeted by phishing attacks in recent years. Earlier this year, the city of Lafayette warned that scammers were sending emails impersonating city departments and requesting fraudulent payments, mainly from people applying for jobs with the city. Similar fraudulent emails requesting payments also circulated in Napa in 2025, and in Fresno, the city lost $600,000 in a wire fraud scam.