Spokesperson of the commission, Mrs Rasheedat Okoduwa, announced this in a statement in Abuja on Tuesday.
She alleged that the money was diverted from the institution’s personnel cost account into the private accounts of an “individual and a company”.
The spokesperson, however, did not mention the names of the suspects who own the accounts.
Also, ICPC begins phase 2 of project tracking in 16 states.
According to her, the anti-graft agency had already taken into custody a staff of UDUTH Accounts department described as the kingpin in the alleged fraud.
“He is being questioned to unravel all those behind this fraudulent act.
“ICPC has also commenced efforts to recover the proceeds of this fraud through the seizure of exotic cars and real estate properties from the main culprit,” she disclosed.
Citing findings from ICPC investigation, Okoduwa said the suspect exploited loopholes in the Integrated Personnel and Payroll Information System (IPPIS) to perpetrate the fraud.
“The fraud was carried out when deductions meant for third parties such as the state board of internal revenue and over-payment deductions were diverted from the IPPIS and channelled into the private accounts of an individual and a company.
“Checks by the commission on how a critical national infrastructure such as the IPPIS could be compromised indicated likely negligence on the part of the management of the teaching hospital and other loopholes.
“For instance, failure to cross-check and reconcile the execution of its budget and allowing officers from the Finance and Accounts Department to access another officer’s password on the platform, present real threats and vulnerabilities,” she explained.
She added that further probe revealed that the suspect exploited “a window of opportunity on the IPPIS platform” to substitute the genuine destination account numbers with those of his co-conspirators before payment.
She said that the window allowed Ministries, Department and Agencies to edit salaries that had been processed by the Office of the Accountant General of the Federation before they were finalised or paid.
“Again, the commission’s findings indicate that the platform does not match account names with account numbers. This loophole created the opportunity for the fraudster to divert the funds successfully for the while that the fraud lasted.
“Investigation into the fraud is ongoing and appropriate actions will be taken by the commission upon conclusion,” she said.