Former IBO IT chief indicted over alleged theft of 4,000 files

BY CARTER MYERS-BROWN

A former chief information officer for New York City’s Independent Budget Office was indicted after allegedly returning to the agency’s offices after his termination and downloading more than 4,000 files containing sensitive government data, prosecutors said.

Monserate Fernandez, who served as IBO’s CIO until January 2025, is charged with third-degree burglary, unauthorized use of a computer and fifth-degree criminal possession of stolen property. The charges were announced by Manhattan District Attorney Alvin Bragg and Department of Investigation Commissioner Nadia Shihata.

“IT professionals working for city agencies are charged with safeguarding the City’s sensitive information and files,” Bragg said in a statement. “Instead, we allege, the former head of IT for the Independent Budget Office downloaded thousands of files to a USB drive that he took home.”

According to court documents and statements made in court, Fernandez was terminated Jan. 17, 2025, after IBO’s information technology infrastructure and maintenance functions were transferred to the city’s Office of Technology and Innovation. He was told he was no longer authorized to access IBO’s physical or virtual resources, and the agency deactivated his employee account and remote access. Locks to the server room and rear office entrance were also changed.

But about a week later, at roughly 8 p.m. on Jan. 24, Fernandez allegedly entered the IBO office without authorization and used a local administrator account to access two computers. Prosecutors allege he then copied more than 4,000 files from IBO’s server onto a USB storage device.

The USB drive was later recovered from Fernandez’s Queens home through a court-authorized search warrant, according to prosecutors.

Shihata said the allegations represented a “serious breach of trust” and an improper taking of confidential government information.

“As charged, this former City IT manager allegedly abused his position by unlawfully gaining entry to a building he was no longer authorized to be in and downloading more than 4,000 files of sensitive data he had no authority to possess,” Shihata said.