Sebastopol recoups almost all of $1.2 million lost in 2021 cybercrime

The original funds were never recovered. Insurance—one city policy and two county policies—covered all but $20,000.

At the last city council meeting on March 7, City Manager and City Attorney Larry McLaughlin announced that the city had now recouped all but $20,000 of the $1.2 million that it lost to a cybercrime in 2021.

The remaining $20,000 was the deductible on one of the insurance policies.

News that the last remaining insurer, Zurich Insurance, had finally paid up on its city policy hit McLaughlin’s in-box in the middle of the council meeting, he said.

The $350,000 payment from Zurich Insurance will be added to the city reserves. The other roughly $830,000 has been added back to the Sebastopol share of the county funding pool from which it was stolen.

McLaughlin said he believes the county—which bears some responsibility for the theft—should reimburse the city for the remaining $20,000.

How it happened

“It was quite a complicated scheme,” McLaughlin said of the cybertheft.

Posing as a Sebastopol city official, the perpetrator emailed an employee from the County Treasurer’s office requesting the funds.

“That particular request, in our opinion…should have alerted staff at the County Treasurer’s office that this was potentially a fraudulent request transfer,” McLaughlin said.

So many things about the transfer should have been a tip-off: The date of the request was wrong, and some of the names of the people involved were misspelled.

The County Treasurer’s office also broke its own protocol about requiring a wait time for large financial transfers. No one from the county called anyone from the city to confirm the transfer of such a large sum of money.

In addition, the county transferred the money to an account in Georgia, “which made no sense in context,” McLaughlin said.

“The city wasn't at fault in any way,” he said.

The crime was discovered “accidentally over a month later,” McLaughlin said, “when there was another transaction with the county, and they happened to mention this earlier one” to a city employee.

McLaughlin said that once the breach was discovered the county and the city worked together cooperatively to make sure Sebastopol got its money back.

“We've been in constant communication with the County Counsel's Office from day one throughout this entire process,” he said. “County Counsel's Office helped us greatly with pursuing the insurance claims that the county had with their own carriers. And we promptly got that money redeposited and credited to us when they recovered it.”

Why did it take so long—almost two years—to get the final payment from the city’s own insurance company, Zurich Insurance?

“They maintained steadfastly that they had no coverage for that and weren't going to pay, and the city was ready to take action against them,” McLaughlin said. “We disagreed with them vehemently. We felt that we did have coverage—that the coverage applied—and that they were wrong. We were going to pursue that and just on the eve of the final need to do that, they changed their mind and covered it completely and paid off their full policy limit.”