A phishing email may have cost one of Manhattan’s luxury landlords nearly $19 million.
Milford Entities, which owns and manages upscale buildings including Liberty Luxe and Liberty View in Battery Park City, mistakenly wired the massive sum to cybercriminals posing as the Battery Park City Authority, according to the New York Post. The July incident, now under federal investigation, involved quarterly PILOT and ground-lease payments collected from condo owners — fees that typically pass through building management to the BPCA.
The Department of Homeland Security is leading a multi-agency probe.
Milford confirmed the fraud in a brief statement, noting the funds involved properties both owned and managed by its affiliates. The company declined further comment to the outlet, citing the active investigation.
The scam appears to have targeted the automated infrastructure of PILOT payments — a quasi-property tax structure unique to Battery Park City, where condo owners pay into a fund that’s funneled to the state-run BPCA.
Milford, which oversees at least nine buildings and more than 2,000 units in the neighborhood, serves as intermediary for a sizable share of those payments.
The BPCA said it never received the payment and was not itself affected. But fallout from the scam has rippled through the neighborhood. One condo board was told $3.5 million of its dues vanished in the transfer.
The BPC Homeowners Coalition, which represents 18 buildings, warned residents in an email that the attack — likely the first of its kind in the area—won’t be the last, urging buildings to review cybersecurity protocols.
The need for strong cybersecurity is only likely to grow in the industry, especially as cryptocurrency becomes more omnipresent in transactions.
Last year, a homebuyer filed a federal lawsuit against his lawyer and the lawyer’s firm in Ridgefield, Connecticut. The buyer blamed the attorneys for a loss of almost $600,000, claiming hackers accessed the firm’s private emails to obtain key information about the transaction, enabling hackers to walk off with $726,000, of which the banks were only able to recover $129,000.— Holden Walter-Warner
Read more
Hacker steals $600K from Connecticut homebuyer
Cybersecurity firm buying West Chelsea office building for $50M
Cybersecurity firm logs on at SL Green’s One Madison