SPARTANBURG COUNTY, S.C. (WSPA) – Hackers allegedly stole over over $8,000 in paychecks following an email hack from an Upstate fire department.

According to the Spartanburg County Sheriff’s Office, deputies responded to the Reidville Fire Department located at 3380 Hwy 417 on a report of fraud/payroll theft.

Once deputies arrived on the scene, they spoke with Fire Chief Patrick Evatt.

Evatt told deputies that six members of the fire department failed to receive their direct deposit on Wednesday.

Deputies said they discovered that someone hacked and/or gained remote access to the Assistant Chief’s employee email and gained access to employee direct deposit information and payroll accounts.

“Talking with the accountants, somehow there’d been an email exchange from who they thought was one of our employees. Which was actually somebody spoofing his email to speak with the accountants,” said Chief Evatt.

The unknown subject(s) then edited the direct deposit information of the six employees resulting in their payroll earnings being deposited into reloadable pre-paid debit cards.

 “There was three different companies that these people used. One was Green Dot’s Bank, one was Sutton’s Bank, and the other was MOVO,” said the Chief.

Accountants immediately tried to retract the payroll sent out Wednesday morning and froze any access to the system.

“Be very, very careful what you open in an e-mail. It may look legit, look like an invoice or anything. But you need to read the email address and make sure it’s identical to who you think is sending you an email,” said Chief Evatt.

The sheriff’s office said a total of $8,156 was taken from the firemen.

“That’ll be recovered to the district either through our insurance or through the accountant’s insurance,” said the Chief.

A CPA firm Greene Finney and Cauley, which manages payroll for the fire department said the IP addresses related to illegal sign-in to the assistant chief’s account were traced back to Nigeria, California and Florida.

The CPA firm has requested reimbursement for the Readvile Area Fire District from the banks connected to the fraudulent activity.

All six firefighters received their paycheck 24 hours later than normal.

The Chief says passwords are being changed and extra precautions are being taken.

“Now, if anybody gets access, there’s going to be email confirmation along with a telephone call,” he said.

With more security.

“Anytime there’s any changes to anybody’s deposit information, direct deposit information, there’s going to be an email exchange, it will be placed in the portal, and they’ll be a phone call,” said Chief Evatt.

Chief Evatt says they are going to do forms of IT and safety training with all their employees, to make them aware of what can happen.