Thank You for Being a Friend

Maine-based artist and writer Ann Tracy was initially thrilled when she got an email inviting her to be a guest on "The New Yorker Radio Hour," a show and podcast hosted by New Yorker editor David Remnick and co-produced by the magazine and WNYC Studios.

But then she realized the email address didn’t look like it belonged to the organization.

“ I'm thinking, 'Oh my God, how did they figure out little old Ann Tracy,'" she said. “Then my intuition kicked in, and I started looking at the email itself a little more closely, and noticed number one, it was from a Gmail account, not from 'The New Yorker Radio Hour' account, and I thought, ‘hmm.’”

According to WNYC’s in-house data security expert, Kenneth Atkins, Tracy was one of dozens of people, many of them authors, who got similar “phishing” emails — fraudulent messages that aim to steal personal information — from accounts impersonating producers or hosts of different WNYC shows, inviting them to be on-air guests. WNYC is part of New York Public Radio, an organization that includes Gothamist.

“The important thing here is that ultimately they ask the authors to provide either some sort of voluntary contribution or a fixed fee to be on the show to cover the cost of promotion and to cover the cost of production,” Atkins said on WNYC’s "Brian Lehrer Show" last week.

But, as host Brian Lehrer emphasized: “Our interviews and our airtime are never for sale, nor do we collect fees from our guests for logistics, production, or anything else that goes into making the show. We will never ask you to pay to come on.”

New York state’s Division of Consumer Protection has tracked more than 6,000 similar impersonation scam reports in the past 12 months across the five boroughs. The agency didn’t find any complaints specifically mentioning WNYC, but instead found three other similar complaints across the country impersonating other public radio stations.

“They were all filed within the past month, so this may be an emerging scam model,” said Mercedes Padilla, a spokesperson for the division.

Tracy told Gothamist the email she received from the phony account was well written, parroting career highlights such as her “continued engagement with theatre through the SnowLion Repertory Theatre Company’s Play Lab” and “your multidisciplinary creative life, spanning performance, writing, and media” as reasons why she would be a good fit for the show.

“ It was almost too well-written to be a scam. And I thought to myself, ‘Well, it could be real or it could be someone using AI crawling my website, getting the information from that, and then working that with AI into an email,” she said.

Tracy’s hunch could be correct, said Rachel Tobac, CEO of San-Francisco-based SocialProof Security. More scammers are using a tactic called “spear phishing,” a targeted form of cyberattack that uses information about their targets available online to craft personalized, deceptive emails with the goal of extracting personal information or money.

“ They're definitely increasing in believability and scalability because of AI,” Tobac said. “Previously, attackers will have to go and draft a phishing message for each and every individual person. It takes a really long time for the attacker to do that.

But now?

"AI can do all of the research, choose the targets, develop the text message or the email or the phone call, even do a voice clone or a deepfake to sound like somebody that they're not.”

Lobbyists, major labor unions, a co-owner of the Flatiron Building and Bronx District Attorney Darcel Clark all contributed to Attorney General Letitia James’ legal defense as she fended off an investigation from President Donald Trump’s Department of Justice.

Documents filed by the Democratic Attorneys General Association show that the national advocacy group spent around $625,000 to defend James from allegations by federal prosecutors in Virginia that she committed mortgage fraud in that state. A federal judge subsequently dismissed the case. Federal prosecutors are reportedly still investigating James in connection with her properties.

Taxpayers, meanwhile, have spent $1.4 million and counting to beat back another investigation by federal prosecutors in Albany, state records show. That tab is expected to rise as the case is appealed. That investigation, according to court filings, is examining James’ handling of a case centering on the Trump Organization’s valuation of properties, as well as another into the National Rifle Association.

On Monday, a former U.S. solicitor general argued that John Sarcone, Trump’s pick to lead the U.S. attorney’s office covering much of upstate New York, should remain barred from continuing the parallel investigation of James.

James and her allies say the charges and investigations are political. Her office prevailed in the Trump Organization case, prompting the Republican president to publicly pressure DOJ leaders to go after James.

That sense of unfairness motivated donors to her legal defense, they said.

“It was a national outrage that the Trump administration would just be so hell-bent on going after our attorney general,” said state Sen. John Liu, a Queens Democrat who donated $200. “We didn't want Attorney General James to feel like … she didn't have everyone in backing her.”

Emily Trifone, a spokesperson for the Democratic Attorneys General Association, said the organization raised more than $1 million for the legal defense fund. Trifone said it’s difficult to determine exactly who donated to James’ legal defense because all contributions go into the organization’s general fund.

Liu said he contributed after a Zoom call organized by the advocacy group 100 Black Men.

Jeff Gural, a real estate developer and co-owner of Manhattan’s historic Flatiron Building, contributed $5,000 to the Democratic Attorneys General Association. He confirmed his donation was aimed at James’ defense.

Other prominent figures donated to the association in the days after James’ indictment. Clark, the top prosecutor in the Bronx, gave $500. Valerie Berlin, a cofounder of the lobbying and public relations firm BerlinRosen, contributed $1,000. Lobbyist Emily Giske donated $3,000.

A political action committee associated with SEIU 1199, a union representing healthcare workers, contributed $50,000 on October 9 — the same day James was charged with mortgage fraud. A union spokesperson said the donation was made to “protect our democratic institutions.”

Local 1180 of the Communication Workers of America, which represents New York City employees, contributed $3,000. A spokesperson didn’t return requests for comment.

Fearing that Trump would seek retribution against his perceived enemies, New York lawmakers created a special $10 million fund for James and others to use for legal defense. James’ office opted not to tap it, saying it wanted to save taxpayer funds, and instead turned to the Democratic Attorneys General Association.

The organization said it set up the legal defense fund to help any state prosecutors who ended up in Trump’s crosshairs. It’s still seeking contributions.

"As Democratic AGs continue to be on the front lines fighting to protect the rights and freedoms of all Americans, President Trump continues to ignore the law and target anyone who disagrees with him,” Trifone said. “DAGA will always defend all Democratic AGs and their staff who are targeted for political retribution by the Trump administration."

The federal investigation of James’ office stalled after Sarcone issued subpoenas for records from her cases against the Trump Organization and the NRA.

James’ office hired an outside law firm, Munger Tolles & Olson LLP, to challenge the subpoenas. Taxpayers are footing the bill because the subpoenas targeted the Office of Attorney General. A federal judge quashed them, finding that Sarcone was not properly appointed to his position and couldn’t lawfully sign off on the subpoenas.

A panel of appellate judges heard arguments over the matter on Monday. James’ office was represented by Donald Verrilli, a former U.S. solicitor general. Under the retainer agreement, partners like Verrilli bill for $1,650 per hour.

The state has paid the firm $1.4 million as of late March, spending records show. James’ office increased its overall contract with the firm to $2.5 million in February, according to the state comptroller’s office.

“Our office continues to defend its work in the Trump Organization and NRA cases against the federal government’s attack on the rule of law,” said Alexis Richards, a spokesperson for the attorney general’s office.

New York City’s public schools system struggles to track which technology its schools use, report breaches on time and notify families when student data is compromised, the state comptroller’s office found in a recent report.

Comptroller Thomas DiNapoli released the audit late last month, about a week before the start of a widespread ransomware breach that ultimately left school districts and colleges around the country without access to the online education platform Canvas. New York City schools, Columbia University, Rutgers University and Princeton University were all among the institutions facing outages this week.

In a statement on Friday, Schools Chancellor Kamar Samuels said the department had recently learned of two data privacy issues. One was “globalized,” affecting up to seven schools, an apparent reference to the Canvas breach. The other, he said, was localized to one campus. Bloomberg cited a memo saying malware had been found on computers at one school community’s shared lab.

DiNapoli’s audit doesn’t address those incidents. It was based on a longer review of the period from March 2020 through September 2025. It found the city’s public schools system — which serves roughly 900,000 students across 1,600 schools — does not maintain a comprehensive list of the various applications each school uses and, as a result, does not have a “clear understanding of its environment, the type of information being stored in these applications, and the various risks associated with the data.”

Auditors reviewed 141 data breaches between January 2023 and February 2025 and found the department delayed reporting nearly half of those breaches to the state, in some cases by more than a year.

“One of the things that we noted in the report is a lack of a centralized inventory,” said Tina Kim, the deputy comptroller for state government accountability. “So, the district is not aware of what specific applications all of the schools are actually using.”

“And if you think about it, that creates a delay because you don’t have a centralized inventory,” Kim continued. “And the reason why inventories are also important is because it allows you to basically do a risk assessment and know if you’re using certain applications that are higher risk, you have to put in certain controls.”

They also found that school district policy didn’t address some areas related to data security and privacy, or publish related materials on the school system’s website. Auditors also said they found “weaknesses in technical controls” used to safeguard student data. And they said a quarter of the department’s roughly 161,000 employees did not complete required annual data privacy training in 2024.

“Historically, when you got a phishing email, there were red flags, there were misspellings,” Kim said. “But artificial intelligence can take away those red flags, and with new technology, you can actually do phishing emails at scale.”

“That’s why training is so important, because artificial intelligence lowers the barrier,” Kim continued. “It basically increases the number of people who have access to these tools and makes it a lot easier to actually do.”

New York City Public Schools didn’t immediately reply to a message from Gothamist seeking comment on Saturday. In a written response to the audit, however, Deputy Chancellor of School Operations Kevin Moran said protecting student data “is of the utmost importance” to the department.

Moran also pointed to a new student privacy webpage and a working group of parents, advocates and school leaders convened in the past year. And while Moran pushed back on some of the survey’s methodology, the department accepted most of the comptroller's recommendations, including developing a way to account for all student information systems and drafting a written data classification policy.

The comptroller's office said it would follow up in a year to check on the district’s progress in implementing its recommendations.