the staff of the Ridgewood blog
CRESSKILL, NJ — A prominent Cresskill property owner is suing the borough, alleging that a preventable cybersecurity failure inside the tax collector’s office allowed more than $550,000 in property tax payments to be fraudulently diverted.
In a lawsuit filed in Bergen County Superior Court, 45 Legion Drive LLC claims hackers gained access to the email account of Cresskill Tax Collector Ada Vassallo between February and May 2024. The attackers allegedly sent spoofed emails containing fake wiring instructions, which the company believed were legitimate directions for forwarding its quarterly tax payments to the borough.
As a result, the LLC wired over half a million dollars—thinking it was paying Cresskill—into fraudulent bank accounts.
What the Lawsuit Claims
According to the complaint:
-
Suspicious activity on Vassallo’s municipal email account was detected as early as February 2024.
-
Despite internal warnings, the borough failed to secure the account, notify taxpayers, or implement basic cyber protections.
-
Between February–May 2024, multiple fake wire instructions were sent to 45 Legion Drive LLC, which owns the commercial office building at 45 Legion Drive (home to several businesses including RD Legal Funding).
-
In total, over $550,000 was wired to fraudulent accounts.
-
The company says it has incurred nearly $200,000 in forensic and remediation costs, with significant funds still unrecovered.
-
Cresskill allegedly did not inform the company of a potential breach until July 2024, after the LLC discovered its tax payments weren’t reflected in borough records.
Who’s Being Sued
The lawsuit names:
-
Borough of Cresskill
-
Tax Collector Ada Vassallo
The suit accuses the borough of negligence, failure to safeguard taxpayer information, and failure to properly notify victims once a breach was suspected.
Officials including Mayor John Morgan and Administrator Dianne Lavin did not return requests for comment.
Why It Matters
This case highlights growing risks of “business email compromise” (BEC) scams, a sophisticated form of cyber fraud targeting organizations that routinely deal with wire transfers.
Local governments with outdated cybersecurity protections are increasingly vulnerable—putting taxpayer dollars and public trust at risk.
Tell your story #TheRidgewoodblog , #Indpendentnews, #information, #advertise, #guestpost, #affiliatemarketing,#NorthJersey, #NJ , #News, #localnews, #bergencounty, #sponsoredpost, #SponsoredContent, #contentplacement , #linkplacement, Email: Onlyonesmallvoice@gmail.com
You have to be a special kind of dumb to wire quarterly tax payments as directed by an email.
Hummmmmm