White Lake Township
White Lake cyberattack delays civic-center financing
Summary
A compromised email transaction diverted bond purchase funds intended for White Lake Township’s civic center. The closing was canceled and some construction paused; replacement financing later allowed work to resume.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
-
Business email compromise
Compromise or abuse of email accounts to facilitate fraud or unauthorized transactions.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
Bond closing was canceled
White Lake Township, Michigan, discovered a cyberattack Nov. 21, 2024, when a bond transaction intended to finance a new township hall and public safety building was compromised. In a Dec. 4 statement reported by WDIV, Police Chief Daniel Keller said some work on the civic-center project would be put on hold while federal authorities, financial institutions and local police investigated.
Email access enabled fraudulent instructions
The township’s subsequent bond statement confirmed unauthorized access to part of its email environment. Investigators found that an unidentified person apparently impersonated a township official and supplied fraudulent wiring instructions. Robert W. Baird & Co., the bond purchaser, wired about $29.1 million to an account established by the criminals, and the sale was canceled.
In a Dec. 20 letter, Keller said the township had received no bond proceeds and that its bank accounts were unaffected. The documented disruption involved the bond closing and construction financing; reviewed sources do not establish a shutdown of township computer systems or emergency services.
Construction resumed
The township sought replacement financing. WXYZ reported May 5, 2025 that bonds had been sold and crews were building foundations. This establishes that construction had resumed by then, although the precise date the pause ended remains unverified.
October 2025 board minutes record the treasurer’s statement that the funding pause increased construction and material costs. The minutes do not give the amount.
Recoveries and liabilities remained distinct
In an Oct. 20, 2025 insurance complaint, Baird said recoveries had left about $5.15 million of the diverted funds unrecovered and that its primary insurer had paid $2.5 million. Those are Baird’s allegations, rather than a determination of the township’s final liability. The original transfer, later recoveries, insurance payments and civic-center project budget represent different amounts and purposes.
Organizations involved
Impacted location
White Lake Township, Michigan
The township and county independently list municipal offices at 7525 Highland Road in White Lake Township. This anchors the affected financial administration; exact parcel mapping is pending after unmatched Census street queries. It does not locate the attacker’s infrastructure or prove servers at the office were compromised.
The existing exact White Lake charter township geography represents the affected municipal authority’s administrative remit. The bond-closing and capital-project delay did not establish a township-wide network or emergency-service outage.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.