The council has, according to a report issued to Wednesday’s meeting of the audit and governance committee, recovered £1m of the money - with the balance covered by the authority’s reserve funds.
A joint investigation - launched by the Metropolitan Police and the National Fraud Intelligence Bureau - occurred when the council alerted officers to the theft, which happened last June.
While several organised crime groups operate in the borough, it’s believed the hackers came from elsewhere in the country and were taking advantage of employees working remotely.
It’s not the first time council bosses have found themselves victims, after fraudsters duped them out of £25,000 by submitting a fake application for a coronavirus grant.
The local authority had prevented five attempts to swindle cash last year following the first lockdown spell in March - totalling £110,000 - but was the victim of one claim.
Rob Winter, head of internal audit, anti-fraud and assurance, said: “We had a major review in light of that.
“We’re working very closely with the team to help them ensure there’s that learning, and there’s lots of changes made to procedures.
“You can never say never, but the control environment is far more robust than it was.
“That said, it was hardly weak before, because all the controls that worked perfectly well for such a long time - it was human error.
“It will be an ongoing journey to prove the new control environment is embedded.
“We are still engaging with the banks, to satisfy ourselves that we’ve got as much information out of the banking system as we can possibly get.
“Despite being a major corporate client of our bank, it’s still proving quite impenetrable - even to the point where I couldn’t lodge a complaint.”
Over the last five years, Rob said the team have contributed to saving or avoiding £1.5m in loss or costs.
Notably, 233 blue badges have been cancelled this year due to being matched to deceased people’s records.
The report said a ‘backlog of reactive work’ has stunted anti-fraud officers’ proactive investigations, with 31 of 34 insurance claims this year identified as not fraudulent, and all 159 right-to-buy applications - for people to buy their council house - confirmed as not fraudulent.
Nine Covid business support grants have been referred to the National Anti-Fraud Network, with one ongoing investigation.