To make matters worst, wrong invoice amounts were sent to the fraudsters and to another legit vendor – all during the chaos following City’s cybersecurity failure.