How a simple misspelling cost an Ohio city $722,000 in a cyberheist
ATHENS, Ohio (WCMH) -- The city of Athens is investigating and suing an unknown thief after it lost $722,000 in a cyberheist.
According to court documents, cyber criminals contacted the city by email and impersonated Pepper Construction Group, which the city has been working with to renovate an old National Guard Armory building into a mixed-use office and event space. The city believed it paid the construction group in November, but just days later a city attorney’s office employee discovered the theft, launching both a civil and criminal investigation.
According to court documents, the electronic payment was routed to a bank account in Louisville, Kentucky, through a fraudulent email where "construction" in the domain name had a slight misspelling, with the second "c" and "u" swapped, and the username matched that of an employee whose name can be found on the firm's LinkedIn page.
Using this email, Athens authorized a $721,976.26 payment. Chief Nick Magruder said the investigation is still in its early stages and involves both Athens police and federal law enforcement. He said the city is unsure if the funds are still in the same account they were transferred to, adding that it's possible there are multiple banks or layers involved.
“We will not know what the transaction flow looks like until responses to subpoenas are filled," Magruder said. "It will take time between when those responses are returned and if additional subpoenas need to be filed based on the responses.”
On Dec. 4, the city filed a lawsuit against John and Jane Doe, as the thieves’ identities remain a mystery, seeking damages. Magruder said in addition to the lawsuit and investigation, the city is also investing in a complete review of its financial controls, conditions for contract invoicing and an independent cyber investigation to protect against future potential crime.
Magruder also said the city has cyber insurance, but it is unknown how much of the losses can be recuperated. He said like any claim, how much is covered will depend on the results of the investigation and who is found liable.
First discovered by the Athens Independent, a bulletin from the Ohio Auditor of State released in April said employee error or failure to follow guidance laid out by the auditor's office could mean the employee is at fault. The statement said in some cases, "the employee is considered liable as a result of negligence or performing duties without reasonable care."
Magruder also said the city is providing additional training for staff on wire transfers and handling money. He confirmed city employees are all required to complete training against cyber crime, and that Athens’ IT department regularly conducts phishing scam and email link tests for staff awareness.