In November, an Athens city employee got an email regarding payment for the construction of a new fire station.
Shortly after, the city paid an invoice for more than $700,000. But the money never reached the construction firm it was intended for.
Instead, the city of Athens was the victim of a sophisticated cyber attack.
It’s not alone. In 2023, the Granville Recreation District lost $713,000 to a phishing scam and a cyber attack cost West Clermont Local Schools $1.7 million.
According to the state auditor’s office, between April of 2023 and 2024, at least 23 local government offices were victims of cyber crimes, resulting in the loss of hundreds of thousands of dollars in public funds.
David Forster, news assignment editor with WOUB Public Media, has been reporting on the cyber scam in Athens. He joined the Ohio Newsroom to explain how the attack happened.
This conversation has been lightly edited for clarity and brevity.
On how Athens city employees fell for a cyber scam
“To understand this scam, it's helpful to first remember that we live in an open society. We expect our government to conduct its business in public. Scammers use this against us. And in this case, through public documents, the scammers were able to learn details about a contract between the city of Athens and Pepper Construction, which was building the city's new fire station.
“The details about this are unclear, but the scammers were somehow able to access Pepper Construction's email system, and they began to monitor exchanges between Pepper Construction and city of Athens employees about the next invoice. At some point, one of the imposters steps into this ongoing email exchange. They were able to do that because they had created two fake email addresses for someone who worked in Pepper Construction’s accounting department. These email addresses were almost identical to the legitimate email address for this Pepper Construction employee. With one email, they used a letter L in place of a letter I, which is very difficult to detect. And in another email address, they transposed two letters.
“So the imposter stepped in and said, ‘Hey, you've been paying us by paper check, but that's a slow process to get all of our subcontractors paid. We'd like you to start paying us through direct deposit into our bank account.’ So the city says, ‘Okay, fine, here's the form you need to fill out to set up the automatic deposit into your bank account.’ The scammers fill out the form and the next payment goes into the scammers bank account.
“The way these scammers operate is they immediately pull the money from that account and send it to another account, and from that account to another account, and ultimately this money almost always ends up in an offshore account. It is incredibly difficult for law enforcement to trace and the odds of recovering any money from a scam like this are very, very thin.”
On the prevalence of cyber attacks in Ohio
“One of the terrifying things I learned in reporting on this story is how incredibly easy it is to pull off a scam like this. In terms of scale, an FBI report showed that in 2023, Ohio cyber scams amounted to close to $200 million, so it's a significant amount of money that's being scammed and these crimes are definitely on the increase.”
On what the state is doing about cyber scams
“The state auditor's office sent out a bulletin last year telling government agencies to be more vigilant. In particular, it told employees to start paying closer attention to email addresses and whenever someone asks to change how payment is made — switching from paper checks to direct deposit or switching from one bank account to another account — to verify that independently.
“Interestingly, and also sort of chillingly if you're a low level government employee, the auditor's office also said that it’s going to start investigating these crimes when they happen. And if it finds that government employees were not following its recommendations — that they were not being vigilant and not taking reasonable precautions — individual employees could be held liable for the losses.”
On whether Athens can recover any of the funds lost
“Usually in cases like this, all the money is offshore within a matter of hours or days after the scam. In this case, there was still about $350,000 in the bank account. Now, of course, the city would like to get that money back, and it has filed a lawsuit against the anonymous scammers in order to get whatever money back it can. However, there's another wrinkle. In this case, these same scammers scammed another company — a big national retail developer based in Florida — and used the same bank account to deposit the money from that scam. So how much of that $350,000 is the city's money and how much is the developer's money? That's going to be for the court to decide.
“The city also has insurance against cyber attacks, so the insurance company is conducting its own investigation. The results of that are expected fairly soon and that will determine how much money the city is able to recover through insurance to help offset its losses.”
