ATHENS, Ohio — The City of Athens will have to pay more than originally appropriated for construction of the new fire station headquarters on Stimson Avenue — mostly to cover funds lost in a cyber theft scam.
Last November, the city lost nearly $722,000 in an email cyber scam; they thought they were sending money to Pepper Construction, but the funds instead went to a fraudulent bank account in Kentucky. In January, Republic Bank and Trust Company revealed that it had recovered almost $350,000 from the account — which also had been used to perpetuate a scam on a Florida real estate company.
At theAthens City Council committees meeting on Tuesday, May 27, City Service-Safety Director Andy Stone said that the fate of the recovered funds is still pending, although the city hopes to get at least some of that balance.
“I have no idea how long that will take,” Stone said.
Meanwhile, he said, “Pepper is basically done. … So we’re at the point where we need to go ahead and make payment.” The total due is “roughly $931,000,” he said.
That total includes the $722,000 lost in the scam, plus another $210,000 for a large parking lot that’s also a soccer/athletic field, a fitness court near the fire station, and an art walk project.
But “we don’t have enough money with the bond proceeds to make the final payment,” Stone said.
Stone proposes increasing the authorized expenditure to $14.352 million, with the money coming from:
- The city’s unappropriated balance ($380,000), including $150,000 in interest accrued from bond proceeds during construction and $200,000 from an insurance claim for the theft;
- General Fund, Fire, 101.208, TC 200 ($27,000);
- General Fund, Other Administrative, TC 200, supplies and services ($25,000); and
- Capital Improvements Fund, 580, TC 600 ($500,000). About 2% of revenue from the city’s income tax goes to the capital improvements fund, said Auditor Kathy Hecht.
All told, the proposal involves only $30,000 in new, unappropriated funding, Stone said. He added that any money the city receives from the $350,000 recovered by Republic Bank will go into the Fire Station Debt Fund.
Hecht said the administration discussed taking out a $600,000 short-term loan to cover the balance.
“That was not something I was willing to go along with, and so we found that $500,000 in the Capital Fund,” she said.
Council member Beth Clodfelter, At-Large, praised Stone’s resourcefulness in finding the funds to pay Pepper Construction. But council member Michael Wood, 3rd Ward, criticized the additional $210,000 in expenditures beyond what the city lost.
Wood said the extra projects should have come before the council.
“I’m just going to point out, [good] intent or no, it’s our job to approve these funds, and if those were spent without our approval that’s a pretty big deal,” Wood said.
Stone said that individually, the extra projects did not go before the council, but collectively they were part of a community asset component it discussed. That includes the city’s Percent for Art policy that sets aside 1% of nonresidential construction projects for public art, he said.
The council will consider an ordinance increasing the authorized expenditure and fund transfers at its Monday, June 2 meeting. The ordinance declares an emergency, meaning that the ordinance may take effect immediately upon the mayor’s signature without the statutory 30-days waiting period.
Steps taken by city against cyber fraud
Council member Micah McCarey, At-Large, asked city administrators what steps have been taken since the cyber theft was discovered in November 2024.
The scammer created a fake email address, with a slight misspelling, that was nearly identical to the one used by the city’s Pepper Construction contact. Records the city released in March (after the Athens County Independent sued to gain access) indicate that the theft was discovered after the scammer used a different fake address.
Hecht and Treasurer Josh Thomas said there are now “extra sets of eyes” on everything. Hecht said her office has changed its standard operating procedures to require two signatures on payments and personal contact for email payments. Thomas said payments for local transactions will be made in person where possible and involve human-to-human contact in all instances.
Stone said the city uses an Microsoft 365 program, which has information technology tools that include a setting to detect emails from infrequent sources. Passwords are reset every 90 days, starting with department heads who have spending authority, he said.
Hecht said the FBI led a training for about 50 people.
Stone also said indications that the cyber fraud did not occur through a breach in the city’s information technology network, but may have occurred through the city’s fire station contractor or subcontractor.
“While Pepper has been very generous in allowing significant delays in our payments to them, they have maintained that they are not at fault regarding the bad actor perpetuating the fraud,” Stone wrote in his email to council. “In the past several weeks, we have reviewed information from Pepper regarding their cybersecurity, and while nothing is certain, we believe it would take a long time, and be very expensive and difficult to ‘prove’ their IT-security was partially to blame enough to justify reducing payment to them.”
In other business on Tuesday, Human Resources Director Ron Lucas told the Finance & Personnel Committee how the city’s diversity, equity, inclusion and access/training coordinator position has transitioned over the past two years into a community engagement and accessibility coordinator.
The position’s focus has shifted more toward serving community members, including newcomers and the elderly, with engagement that involves relationship-building and access to resources, Lucas said. The community engagement coordinator also serves on specific committees that involve outreach.
At its June 2 meeting, council will consider an ordinance that officially changes the position’s title from DEIA/Training Coordinator to Community Engagement and Accessibility Coordinator.
Athens City Council’s next regular meeting will be at 7 p.m. on Monday, June 2, in Athens City Hall, Council Chambers, third floor, 8 E. Washington St. Meetings are also streamed online. Regular sessions are on the first and third Mondays of the month; committee meetings are on the second and fourth Mondays.
Correction and clarification: A previous version of this article implied that the council may pass an ordinance on first reading if it includes an emergency declaration. An emergency declaration is not suspension of the rules, an action wherein the council may pass legislation on first reading; Rather, an emergency declaration expedites the ordinance’s implementation. We have corrected this article and apologize for any confusion this conflation may have caused.
