A "sophisticated" organised crime group stole £1.1m intended to renovate a secondary school after fooling a council into paying the money into a different bank account, an inquiry has found.
The cash was stolen by the gang after it managed to pose as an employee of a business group involved in the project, and requested Luton Borough Council transfer the money into a different account.
Both the council and South East Midlands Local Enterprise Partnership (SEMLEP) were victims of serious fraud, according to a report from the National Investigation Service (NATIS).
It concluded that the theft was "perpetrated by a highly sophisticated and organised criminal group, with ties to money laundering and cyber-enabled crime", the council said.
The council discovered in April 2020 the finance for the redevelopment of Mark Rutherford School in Bedford had vanished mysteriously, reports the Local Democracy Reporting Service.
It emerged the funding had been misappropriated and paid to "persons unknown", so Bedfordshire Police were contacted.
The county police force began its investigation in June 2020 before later revealing the inquiry was being handled by NATIS.
SEMLEP issues government grants for local projects. The local authority acted as a banker for SEMLEP, receiving the government funding before passing it on to the designated projects.
The council said: "The investigation followed the misdirection of £1.1m of a SEMLEP local growth fund grant in 2020. The funding was intended for Mark Rutherford School in Bedford. Luton Council acts as SEMLEP's accountable body.
"The report confirms that a user account of a SEMLEP employee was illegally compromised by a criminal entity, which then contacted the council to advise of a change of bank account details for the school where the payment was due to be made.
"Despite extensive inquiries and identifying several potential suspects, NATIS has been unable to recover any of the funds. Its investigation continues and is likely to be long-term and worldwide."
'Nasty and sophisticated cyber-criminal gangs'
The report made recommendations to both the council and SEMLEP to further strengthen their internal processes, which have since been put into practice.
The local authority's chief executive Robin Porter said: "There's been much misinformation circulating in the media and social media for the last two years about the council's role in this case.
"So I'm pleased the report has been finalised and evidence presented. The findings confirm that it wasn't the council's system which was compromised and we're pleased that the investigation clears this up.
"But this crime shows how vigilant all organisations need to be with such nasty and sophisticated cyber-criminal gangs operating around the world.
"We accept the conclusions of the NATIS report. As a result of this incident, we've introduced higher levels of risk management to further strengthen our payment policies and ensure extra checks are made when we're sent requests such as change of bank details."
The school has received money for the project subsequently, having been due to obtain its finance before it disappeared by March 2020.
An update report is due to be presented to the council's scrutiny finance review group on Wednesday as committee members have criticised the length of time it has taken to release the findings previously.
Want a quick and expert briefing on the biggest news stories? Listen to our latest podcasts to find out What You Need To Know