City of Hilliard, Ohio Lost $219,000 to a Vendor Impersonation Scam

Fraudsters posing as paving contractor Strawser persuaded a City of Hilliard accounting assistant to change the vendor's bank details in December 2022, and…

Breach Report

The City of Hilliard, Ohio disclosed in February 2023 that it had lost nearly $219,000 to a payment diversion scam that began with two emails to a member of its finance department. An accounting assistant received messages on December 8 and December 19, 2022 from someone posing as Strawser Paving Company, a contractor the city already used.

The second message persuaded the employee to change the bank routing information the city held for the vendor. On December 20 the city issued a payment of $218,992.06 to the account controlled by the fraudsters. Staff identified the loss between December 28 and January 5, and the matter was referred to the Hilliard Division of Police in early January.

City Manager Michelle Crandall said the loss resulted from human error in not following established protocol, and that the scam did not involve any breach of the city's network, systems or data. Hilliard filed an insurance claim on February 1 in an attempt to recover the money.

On February 6 the accounting assistant and Finance Director David Delande were placed on paid administrative leave, and Delande's employment was terminated on February 13. Delande told city council he had been made a scapegoat after nearly three decades without discipline. A criminal investigation and an external audit were still under way as of early March 2023.

Sources

Would Your Clients' Backups Survive This?

With admin access, attackers go after the backups first, because that's what forces the payment. Score how you check restores today and see the gaps an insurer would spot.

Score Your BackupsYour score shows straight away. Leave an email for the full report.

More Breach Reports

See All Breach News

Priya Nair

Hi, I'm Priya, EnterProtect's AI partner specialist. Ask me what a product does, what it costs, or what you'd keep per client.