Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity Fraud topic
No spam. Unsubscribe anytime.
Council authorizes law-firm investigation after $27,000 invoice phishing scam; city faces $10,000 deductible
Summary
At a special City Council meeting, the clerk reported a phishing scam that resulted in an unauthorized ACH payment of roughly $27,000. Council approved an engagement letter so McDonald Hopkins, the insurer's contracted law firm, can investigate; the city expects to pay a $10,000 deductible.
The clerk reported that an email impersonating contractor HR Green led to an unauthorized ACH payment of about $27,000 and asked the council to authorize an investigation.
"I, for lack of better words, as your clerk, was scammed in an email," the clerk said, describing how she received invoices on June 26, set up an ACH payment on July 9 and later realized the message was fraudulent after questioning the request the following morning.
Why it matters: The clerk said the city has notified the contractor, the bank, the mayor, the Johnson County Sheriff's Office and the city insurer, ICAP. ICAP has arranged for McDonald Hopkins to perform a full investigation; the law firm's fees will be paid by ICAP but the city is responsible for a $10,000 cybercrime deductible.
Council members pressed officials on recovery prospects and on whether the breach originated inside the city's systems, at HR Green, or elsewhere. "So what's the best case scenario going forward... will we recover any of this money?" a council member asked. The clerk replied that recovery was unlikely and that the city would be out the deductible: "We will be out $10,000."
The clerk said she contacted HR Green, which denied sending the fraudulent email, and that HR Green's IT staff and the city's internet/email provider were consulted. The clerk also said the city's email password had not been changed since the account was created in 2009 and that staff will seek a professional IT firm to review network security and device configurations.
Council action: A council member moved to approve the engagement letter so McDonald Hopkins could proceed and for the mayor to sign. No opposition was recorded and the Chair stated the motion carried, authorizing the engagement.
What happens next: The clerk said ICAP's investigation could take three to four weeks and that the sheriff's cybercrime division may refer matters to the FBI if the case crosses state lines. Separately, staff will bring proposals for hiring a professional IT vendor to harden the city's systems.
The meeting adjourned after the vote.
