December 2022 - CORSA-broadcast

Business Email Compromise: The $43 Billion Scam
by Frank Hatfield Dec. 13, 2024

Dec. 13, 2024

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The scam is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds. The scam is not always associated with a transfer-of-funds request. One variation involves compromising legitimate business email accounts and requesting employees' Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets. Losses associated with BEC scams quadrupled last year to an astonishing $43 Billion according to the FBI statistics below. Just last week about $4 million in federal funding intended for housing assistance in Kentucky was stolen after someone directed that money to a private bank account. (Source: https://www.cnn.com/2022/08/29/politics/kentucky-4-million-cyber-theft/inde… ) "These types of attacks can be especially impactful to state and local governments that may do business with dozens, if not hundreds, or different vendors," Hassold, who is now director of threat intelligence at cybersecurity firm Abnormal Security, told CNN. FBI SUGGESTIONS FOR PROTECTION * Use secondary channels or two-factor authentication to verify requests for changes in account information. * Ensure the URL in emails is associated with the business/individual it claims to be from. * Be alert to hyperlinks that may contain misspellings of the actual domain name. * Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate. * Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from. * Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed. * Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits. Source: FBI Public Service Announcement https://www.ic3.gov/Media/Y2022/PSA220504 CORSA is committed to keeping members informed of and protected against threats to their financial assets and systems. BEC and/or payment fraud is on the rise which creates considerable exposure to governmental entities, including CORSA members. Current technology provides sophisticated criminals the tools to create or alter checks or divert payments via BEC or social engineering. In addition to the FBI's above recommendations, CORSA strongly encourages members to enroll in the anti-fraud services Positive Pay and ACH Positive Pay. The Ohio Auditor of State also recommended enrolling in the above anti-fraud services to guard against check fraud. (See: Auditor of State Best Practices https://ohioauditor.gov/publications/bestpractices/best%20practices%20sept%…) Positive Pay is a service that essentially requires bank customers to provide their bank with a list of checks that are to be paid, while payment is withheld for any checks that don't match the customer's list. The ACH Positive Pay service allows a customer to set parameters on payments. For instance, payments that occur regularly with similar amounts can be set up to pay automatically, while any payments that fall outside normal transactions will be suspended until authorized. Most banks offer Positive Pay and ACH Positive Pay for a fee. In CORSA's experience fees vary, but customers are able to significantly lower fees through negotiation. Should you have questions regarding Positive Pay or ACH Positive Pay contact Thisbe Butcher at tbutcher(a)ccao.org<mailto:tbutcher@ccao.org> [Chart depicting Reported Loss Associated with BEC/Cryptocurrency Complaints for the years of 2018, 2019, 2020, and 2021.] Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image002.png@01D8BD3E.0B6EC360] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 2

Freezing and Bursting Pipes
by Jim Hale Aug. 30, 2023

Aug. 30, 2023

As a pool CORSA has all too many high severity losses every year due to freezing and bursting pipes. In fact, freezing/bursting pipes in the aggregate accounts for much of our yearly property losses as a pool. Attached is some additional information on this all too common loss for our members. Extracted from the document: "Surprisingly, ice forming in a pipe does not typically cause a break where the ice blockage occurs. It's not the radial expansion of ice against the wall of the pipe that causes the break. Rather, following a complete ice blockage in a pipe, continued freezing and expansion inside the pipe causes water pressure to increase downstream -- between the ice blockage and a closed faucet at the end. It's this increase in water pressure that leads to pipe failure. Usually the pipe bursts where little or no ice has formed. Upstream from the ice blockage the water can always retreat back towards its source, so there is no pressure build-up to cause a break. Water has to freeze for ice blockages to occur. Pipes that are adequately protected along their entire length by placement within the building's insulation, insulation on the pipe itself, or heating, are safe." James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209

1 1

First Amendment Audits
by Frank Hatfield April 21, 2023

April 21, 2023

Over the last few years citizen activists have been conducting "First Amendment Audits" with increasing frequency. This phenomenon does not appear to be led by an organization; rather, audits are conducted by individuals interested in videoing law enforcement and other public officials and offices. Although conducted by individuals, organizations such as the ACLU provide guidance and encourage First Amendment audits. (See ACLU: https://www.aclu.org/know-your-rights/protesters-rights/#i-want-to-take-pic….) Frequently, these video audits are posted online and, if a perceived First Amendment violation occurred, the videos are the basis for a civil lawsuit. Now is a good time to review and update or create, if necessary, your County's protocol with regard to citizens videoing County operations. Fortunately, counties and public offices, such as Union County, have prepared well to withstand a "First Amendment" without incident. Union County, specifically Sheriff Patton, was kind enough to share the attached memorandum regarding recent "First Amendment Audit" activity and permit it to be distributed by CORSA broadcast email. Thank you Union County. The attached is not legal advice nor should it be construed as such. Should you require a legal opinion please contact your Prosecutor's Office or legal counsel. Frank Hatfield, Esq. CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

2 1

Winter Storm Over Holidays
by Jim Hale Dec. 21, 2022

Dec. 21, 2022

The forecast over the holiday is for the potential of very low temperatures, high winds and possibly heavy snow. Since counties have extended time off over the holiday period CORSA recommends members take precautions: Prior to the event: * Make sure that all items that can be blown around by high winds are secured. * All piping that may be exposed to the extreme cold are covered/insulated against freezing. * Snow removal equipment and supplies are in place and ready. After/during the event: * Immediately check building interiors for bust pipes. * Check exterior areas for wind damage and exterior burst pipes. Because this storm will happen over the holidays when buildings may not be occupied CORSA strongly recommends the members have someone inspect the building interiors as soon as the event ends rather than waiting until employees normally return to work. The loss caused by a burst pipe that runs for an extended period before it is discovered can cause very high losses. James Hale, ARM-P, ARM-E, CPSI Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." [cid:image001.png@01D91528.2B9524D0] CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

RISK CONTROL SERVICE BULLETIN – 12/2022
by Tricia Callihan Dec. 5, 2022

Dec. 5, 2022

Hello all, please read the attached Risk Control Service Bulletin reminder regarding maintaining the monthly monitoring drivers list. Tricia Callihan CORSA Program Assistant Direct Dial - 614-220-7993 Cell Phone - 614-400-2088 Fax - 614-220-0209 "The leader in providing Ohio Counties with exceptional value, services, and protection of assets." [cid:image001.png@01D9088D.DE0A53D0]

1 0

Cybersecurity
by Tricia Callihan Dec. 1, 2022

Dec. 1, 2022

I hope December is off to a good start for everyone. Thank you for all of your effort throughout the year to mitigate against cyber threats and thank you in advance for your continued efforts. If you will be at the 2022 CCAO/CEAO Winter Conference please mark your calendars to attend at 8:30 am on December 8th in Room Taft AB 1st floor, "The Bad Guy Sitting in Your Inbox!" or a.k.a Business Email Compromise (BEC). CORSA is pleased to sponsor this session that will be moderated by the talented and personable Dave Wilson, Guernsey County Commissioner and CORSA VP. This session will provide a better understanding of the current cyber threat landscape and how you can protect yourself and your county from falling victim. We are very excited that Tony Rucci, Cybersecurity Consultant, will conduct this session which includes a Live Darkweb Demo and various examples of BEC. Attached is Tony's impressive biography. Also attached is information pertaining to CORSA's 2022 Cybersecurity Reimbursement program. There is still funding available for those members that have not taken advantage of this program in 2022. Please don't delay submit your applications without delay but not later than 12-31-22 as the program closes at year's end. Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image001.png@01D904B0.CD58BBC0] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0