Hacker takes money from Aurora, city suing insurance company

AURORA – City officials discussed the loss of $233,585.04 to a hacker’s scheme in February 2022 amid the construction of the Aurora Family Aquatic Center and litigation against the city’s insurance provider, National Fire & Casualty Co., during a July 10 city council meeting.

The city has sued the insurance company to recoup some of the money city was out.

According to court documents, Aurora Clerk/Treasurer Benjamin Turner fell victim to the hacker who intercepted an email correspondence between Turner and a representative Maxwell Construction Co., the company working on the aquatic center’s pool. During the email conversation, the hacker asked for the next partial payment using a nearly identical email address of Maxwell Construction, with one letter changed in an attempt to defraud Turner, who has expertise in banking and accounting.

Court documents state the hacker, who first emailed former Aurora City Manager Derek Walker who replied to the email and copied Turner and Deputy Clerk Oren Turner in the correspondence, requested the city transfer $233,585.04 via an ACH (Automated Clearing House) transfer because the construction company was in the process of switching from paper checks to fully electronic banking.

The following day, the hacker replied to Turner and stated the electronic fund transfer was denied by the city’s bank, Civista Bank, and asked Turner to transfer the money electronically to a bank account, at JP Morgan Chase, provided by the hacker. After sending the money electronically to the account provided by the hacker, Turner became suspicious and inquired with the construction company’s representative regarding the transfer; the representative stated he had not requested a payment from the city.

Turner then notified representatives at Civista and requested the transfer be stopped; the bank was unable to stop the electronic transfer.

Aurora filed an insurance claim with National Fire & Casualty last Aug. 1. The insurance company denied the claim 10 days later citing “the city’s loss did not emanate from or within a computer system that it owned, leased or operated,” and the instructions to pay the fraudulent bill was “actually made by city staff and not someone else without your knowledge.”

Aurora is now suing its insurance provider, National Fire and Casualty Co., for $99,750 (the policy has a $250 deductible with a $100,00 max payout for an eligible claim), claiming the loss is covered under the city’s policy. National Fire and Casualty denied the city’s claim citing the loss was not covered.

The lawsuit, filed in Dearborn County Circuit Court in January, was moved to the New Albany Division of the U.S. District Court of the Southern District of Indiana.

“It is ongoing litigation. We are fighting right now and so it would be detrimental to us to make comments because any comment we make could be used against us at this point,” said Aurora City Attorney Jared Ewbank. “We can confirm that that did happen though.”

Aurora resident Mike Crider said he thinks the residents should know about the incident.

“As a concerned citizen and taxpayer, I think I should know a little bit about it, that’s why I am asking,” Crider said. “I think that everybody in the city, taxpayers, should know about it.”