After a cyberthief stole nearly $713,000 from a Granville Recreation District loan fund at Park National Bank late last year, the theft set in motion a series of ongoing investigations.
In December, the GRD board signed off on a $713,000 wire transfer of funds from a bond note held by Park National Bank — effectively a loan to the district from the bank — to pay the Shelly Company for paving work at Wildwood Park on the west side of Granville and Raccoon Valley Park on the southeast side.
But a month later, when Shelly asked about payment for the work, GRD officials realized something had gone wrong, Wildman said.
The money never made it to the company. The bank had wired the money to a fraudulent account on Dec. 22, according to a Granville Police Department report.
“Someone was able to enter into an email thread and provide information to an ACH [automated clearing house] account for payment of services rendered,” according to the police report. “This was a fraudulent account (not the intended recipient) and the funds were wired to it.”
“It was approximately 11:57 a.m., not that I have that burned in my mind, when we were made aware of the situation,” GRD Executive Director Andy Wildman said in late April, nearly three months after the organization reported the incident to the police. “At that point, we just started working 24/7, filing reports with the FBI, the attorney general, the local police.”
In addition to filing reports with the authorities, Wildman said the district contacted its insurance company and TrustedSec, a cybersecurity company, to launch a series of internal investigations into the incident and try to determine how it happened, and determine how to ensure it won’t happen again.
“We did an internal forensics investigation and a ‘BEC’ investigation, which is a business email compromise investigation,” Wildman explained. “We wanted to use that as an opportunity to explore areas that we could improve in terms of our [information technology] and what we were doing.”
Representatives from the Shelly Company, of Thornville, did not return The Reporting Project’s requests for comment, and a manager at Granville’s branch of Park National Bank said he couldn’t comment on the situation, then referred a reporter to the bank’s marketing department, which did not respond.
The district has since expanded cybersecurity and training protocols, added additional cyber insurance, adjusted how it handles invoices and has adopted a new information technology provider to “make sure that we’re as secure as we can be,” Wildman said.
Existing protocols and oversight within the GRD are designed to ensure proper handling of funds, and they have been in place for several years, Wildman said. Any transactions greater than $5,000 require board approval, and paper checks require two signatures on them, Wildman explained.
“This transaction, because of the note with the lender, required board action, and obviously, with the size of the payment being over $5,000, it required board action, but this was a wire — not a check,” he said. “The board approved the project and the payment after the project was completed.”
“We take our role as fiscal stewards very seriously,” he added.
In this instance, the board and the GRD staff followed protocol, he said, but none of the parties involved — the GRD, Park National Bank, and the Shelly Company — realized a breach had occurred until late January, well after the bank had wired the funds.
The $713,093.04, though, was never in the GRD’s bank accounts, board member Greg Lott said in February.
“We were working with a lender to do a bond note that would pay the contractor in a lump sum when the project was complete, and then we would repay the lender back … over a five-year term,” Wildman said.
The GRD paid a bond counselor an additional $7,500 for preparation of bond notes, bringing the total cost of the loan to about $720,000.
Although none of the funds have been recovered, the GRD’s insurance company is expected to cover at least some of the loss. The district has cyber-fraud-related insurance as well as coverage under the Ohio Plan Risk Management Inc.
“We are working with our insurance company and all the parties involved in the ongoing investigation,” Wildman said. “We believe our insurance is going to cover $275,000.”
It’s unclear what will happen to address the other $445,000 that is still missing, although Wildman said “our leadership team is doing everything we can every day to make sure that we do not spend taxpayer money to solve this issue.”
In the meantime, the GRD has handed over the investigation to BakerHostetler, one of the largest law firms in the United States with more than 1,000 lawyers and 17 offices across the country, including in Columbus, Cincinnati and Cleveland.
“BakerHostetler is a reputable firm, and they have a lot of expertise in this space,” Wildman said. “They will take over this issue for us, and then move forward with the appropriate steps.”
The firm has a partnership with the Ohio Plan, the GRD’s insurance company since the district was formed in 2010.
The Ohio Plan was formed in 1988 to provide “affordable, comprehensive property and liability coverage to Ohio’s public entities,” according to the GRD’s insurance policy, prepared by Rinehart, Walters, Danner Insurance.
Wildman said the multi-site paving project was one of the largest undertaken by the GRD since he became director in May 2010.
The GRD offers dozens of activities throughout the year, including youth sports such as wrestling and baseball, art classes, Beyblade clubs and adult soccer leagues. The district also manages McPeek Lodge, Raccoon Valley Park, the Spring Valley Nature Preserve, and Wildwood Park, with a total annual budget of about $1.25-1.5 million.
In mid-2020, Wildman told The Newark Advocate the district had an operating budget of “somewhere between the $850,000-900,000 range, and it’s about 50/50. We collect about half from user fees and half comes from taxation/subsidization.”
That budget number went up by approximately $384,525 per year after Granville voters approved a five-year, 0.75 mill operating levy in 2020.
Wildman said the GRD would be able to proceed with all of its scheduled programs this summer, including youth sports, a Barbie Dance Camp, Detective Academy, dozens of day camps and the well-attended Concert on the Green series.
“This does not impact our commitment to providing the best programs that we can, the best concert series that we can, the best facilities, the best community garden,” Wildman said. “In terms of programming, we have had zero impact.”
Julia Lerner writes for TheReportingProject.org, the nonprofit news organization of Denison University’s Journalism program, which is sponsored in part by the Mellon Foundation and donations from readers. Sign up for The Reporting Project newsletter here.