- CORSA-broadcast - lists.corsa.org

Employment Claims Increase
by Frank Hatfield Jan. 23, 2025

Jan. 23, 2025

Employment discrimination charges and lawsuits are on the rise. The Equal Employment Opportunity Commission (EEOC) received 88,531 new charges of discrimination in FY 2024, reflecting an increase of more than 9% over FY 2023. The EEOC secured nearly $700 million for charging parties, a 5% increase over FY 2023 and the highest monetary recovery in recent history. The EEOC also filed 57% more merit lawsuits against employers in 2024 versus 2023. The EEOC just released its annual report which can be found at: EEOC Publishes Annual Performance and General Counsel Reports for Fiscal Year 2024 | U.S. Equal Employment Opportunity Commission<https://www.eeoc.gov/newsroom/eeoc-publishes-annual-performance-and-general…> Now is a good time to review and update as necessary your employment policies and practices if you have not done so recently. CORSA provides several Human Resources template policies, trainings, services, and resources that can be found at: www.corsa.org<http://www.corsa.org>. As always, feel free to contact me with any questions about CORSA loss control offerings. Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Current Cold Snap and Frozen Pipes
by Jim Hale Jan. 22, 2025

Jan. 22, 2025

After a cold snap when the temperatures warm is the time CORSA see the frequency of burst pipes skyrocket. It looks like our current freeze will be coming to an end on Friday or Saturday. Warm-ups over a weekend are especially problematic because many buildings will not have staff for an extended period. Best Practice is to have your facilities staff regularly (as often as practicable) check your buildings for problems including frozen and/or burst pipes. Attached is some basic information about frozen pipe and thawing them if they occur. One very important note: Never use open flames of any kind to thaw frozen pipes and be aware of other hazards such as using electrical devices near water. James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets."

1 0

Extreme Cold is Here - Frozen Pipes and Other Winter Hazards
by Jim Hale Jan. 16, 2025

Jan. 16, 2025

During the winter season, counties face a unique set of property challenges, including the risk of frozen pipes and sprinkler systems. These issues can result in costly damage, disruption of operations and potential safety hazards. It is essential to understand which pipes and systems are most vulnerable to freezing, the impact of cold weather on pipes and sprinkler systems, and how to take preventive measures to protect your business's operations. Along with frozen pipes many other winter hazards can also occur. These include excessive snow loads, slip and fall hazards and dangerous ice dams on the roof. The attached materials provide guidance on mitigating these hazards. James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets."

1 0

vehicle use policy
by Jamie J. Arcaro Jan. 13, 2025

Jan. 13, 2025

Good Morning, We have been updating our vehicle use policy and reached a snag, proof of insurance. When it comes to the CORSA vehicle sample policy it states that employees need to provide proof of insurance. What is the best way to track this? I feel that is we ask everyone for proof of insurance they will complain or not provide it, leaving more work for me to track them down, and I have no way of confirming that what they provide is current or active. We do have and use annual drivers licenses checks. It is stated on out annual drivers licenses check form that- I, the undersigned, agree, as a requirement for using my personal vehicle during the course of my employment with Ashtabula County, will retain automobile liability insurance for bodily injury and property damage on the vehicle that I am driving for at least the minimums required by the Vehicle Usage Policy in the Ashtabula County Personnel Policy Manual. I further agree to maintain my vehicle, to the best of my knowledge, in roadworthy condition. How are you dealing with this issue? Jamie J. Arcaro Ashtabula County Commissioners Workers' Compensation and Risk Specialist 25 West Jefferson Street Jefferson, OH 44047 Phone: 440-576-3748 Fax: 440-576-2344

1 0

How a simple misspelling cost an Ohio city $722,000 in a cyberheist
by Frank Hatfield Dec. 26, 2024

Dec. 26, 2024

I hope everyone is well this holiday season. Unfortunately, cyber criminals continue to remain busy throughout this time of year. Below is recent example of a payment redirection scam perpetrated on an Ohio city. Full article at the link below. Attached is a recent Ebroadcast with links to cyber loss control resources. We wish you all the best for the remainder of this holiday season and a Happy and Safe New Year. Stay safe. The electronic payment was routed to a bank account in Louisville, Kentucky, through a fraudulent email where "construction" in the domain name had a slight misspelling, with the second "c" and "u" swapped, and the username matched that of an employee whose name can be found on the firm's LinkedIn page. Using this email, the City authorized a $721,976.26 payment. How a simple misspelling cost an Ohio city $722,000 in a cyberheist | NBC4 WCMH-TV<https://www.nbc4i.com/news/local-news/athens/how-a-simple-misspelling-cost-…> Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Ohio Auditor of State - How to Protect Your Organization from Spear Phishing and Payment Redirect Scams
by Jim Hale Dec. 13, 2024

Dec. 13, 2024

In recent years, Ohio's local governments, school districts, and other public entities have increasingly been targeted by cybercriminals employing payment redirect and other business email compromise (BEC) schemes. These scams, often involving spear phishing, have led to significant losses of taxpayer dollars. Drawing on recent cases involving various public entities, it's essential for government officials to understand these attacks and the principles of cybersecurity to mitigate risk. Understanding the Threat In payment re-direct and other BEC scams, cybercriminals impersonate trusted vendors, employees, or business partners to deceive organizations into transferring money to fraudulent accounts. They do this by manipulating email correspondence, often using subtle changes to email addresses that can easily go unnoticed. For instance, an email might change from "vendor(a)example.com" to "vend0r(a)example.com." These schemes are often sophisticated and tailored, with criminals mimicking legitimate communications. Earlier this year, a recreation district in Central Ohio fell victim to a spear phishing attack involving fraudulent payment instructions from an email account that looked almost identical (only a single letter was changed) to that of a trusted contractor who was working on a large project. The vendor's account information was changed, which resulted in $713,000 going to the scammer's account. It was only after the vendor contacted the recreation district about the missing payment that the crime was discovered. Similarly, a school district in Clermont County and a school district in Cuyahoga County lost $1.7 million and nearly $620,000 respectively because they didn't properly verify payment information change requests from fake email addresses that appeared to be from legitimate contractors. Preventing Scams While we recognize there is no perfect system to prevent 100% of scams, taking proactive steps can dramatically reduce the chance of a loss. Here are some key principles and recommended actions to reduce the risk: 1. Verify and Validate Requests Never make changes to a vendor or employee's banking information without in-person verification. Don't rely on information in the change request email. Always use contact information from validated sources, such as previous invoices or official directories. In 2023, a village in Huron County suffered financial losses when the fiscal officer made payments totaling $269,000 in response to fraudulent invoices. This incident could have been avoided by using an independently verified contact method to confirm the legitimacy of the change. 2. Require In-Person (or Independent) Confirmation Verify change requests in person. If this is not possible, use only independently verified contact information and ask specific questions that only the legitimate requester could answer. Employees should develop a heightened sense of scrutiny, especially when a request for a change in payment information arrives unexpectedly or is accompanied by a sense of urgency. In the case of a township in Ottawa County, a spoof email requesting a change to an employee's direct deposit information led to five payments totaling $3,500 being transferred to a fraudulent account. Likewise, a school district in Seneca County lost nearly $2,000 after processing a fraudulent request to change an employee's direct deposit information. Had there been a policy requiring in-person verification or secondary approval, these attacks could have been prevented. 3. Separate Duties and Use Dual Authorization Separate the functions of payment change initiation and payment approval. Implement internal, secondary approvals for all requests involving changes to payment instructions or contact details. This ensures that no single individual can unilaterally change critical payment information without oversight. An agency in Stark County experienced losses of nearly $29,000 because six deposits were redirected to an unauthorized account following changes made without proper independent verification. Requiring dual authorization could have provided a safeguard against this fraud. 4. Employee Training and Awareness Providing continual training and education to employees about policies, procedures, and recent phishing threats is critical. Employees are often the first line of defense against fraud schemes, and consistent awareness training helps them recognize potential threats. 5. Use Technology to Assist Use layers of authentication, such as financial institution tools like ACH positive pay or debit block programs. These tools can help prevent unauthorized transactions from occurring by flagging discrepancies before money leaves the account. 6. Develop a Proactive Security Culture Public entities should create an organization-wide culture of security. Employees should feel comfortable questioning suspicious emails or requests, and there should be clear policies for dealing with any anomalies. A township in Belmont County avoided falling victim to a spear phishing attack because of the strong internal controls they had in place. When the township received a suspicious email requesting changes to payment information, they identified inconsistencies and flagged the request as fraudulent, preventing any financial loss. This is a great example of how proper verification and adherence to policies can safeguard against cyber threats. Conclusion The financial losses resulting from spear phishing and BEC scams can be devastating for public entities, affecting services and eroding public trust. However, with proper training, verification procedures, and a security-conscious culture, many of these incidents are preventable. Here's what do if you suspect your organization has been compromised by a cybercrime: first report the payment thefts to your financial institution to try to stop the transfer. Then notify local law enforcement. Next, contact the Ohio Auditor of State<https://ohioauditor.gov/fraud/default.html#ReportFraud> and report it to federal agencies including the Federal Bureau of Investigation's Internet Crime Complaint Center (IC3). By following these guidelines, including requiring in-person verification, watching out for red flags in email correspondence, implementing dual authorization, and consistently training employees, your organization can protect itself from falling victim to these sophisticated scams. [Keith Faber] How to Protect Your Organization from Spear Phishing and Payment Redirect Scams Keith Faber Ohio Auditor of State For the full article go to: https://ohioauditor.my.canva.site/ohio-auditor-payment-redirect-scams Also see the attached Payments Security Checklist. James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets."

1 0

Business Email Compromise: The $43 Billion Scam
by Frank Hatfield Dec. 13, 2024

Dec. 13, 2024

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The scam is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds. The scam is not always associated with a transfer-of-funds request. One variation involves compromising legitimate business email accounts and requesting employees' Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets. Losses associated with BEC scams quadrupled last year to an astonishing $43 Billion according to the FBI statistics below. Just last week about $4 million in federal funding intended for housing assistance in Kentucky was stolen after someone directed that money to a private bank account. (Source: https://www.cnn.com/2022/08/29/politics/kentucky-4-million-cyber-theft/inde… ) "These types of attacks can be especially impactful to state and local governments that may do business with dozens, if not hundreds, or different vendors," Hassold, who is now director of threat intelligence at cybersecurity firm Abnormal Security, told CNN. FBI SUGGESTIONS FOR PROTECTION * Use secondary channels or two-factor authentication to verify requests for changes in account information. * Ensure the URL in emails is associated with the business/individual it claims to be from. * Be alert to hyperlinks that may contain misspellings of the actual domain name. * Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate. * Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from. * Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed. * Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits. Source: FBI Public Service Announcement https://www.ic3.gov/Media/Y2022/PSA220504 CORSA is committed to keeping members informed of and protected against threats to their financial assets and systems. BEC and/or payment fraud is on the rise which creates considerable exposure to governmental entities, including CORSA members. Current technology provides sophisticated criminals the tools to create or alter checks or divert payments via BEC or social engineering. In addition to the FBI's above recommendations, CORSA strongly encourages members to enroll in the anti-fraud services Positive Pay and ACH Positive Pay. The Ohio Auditor of State also recommended enrolling in the above anti-fraud services to guard against check fraud. (See: Auditor of State Best Practices https://ohioauditor.gov/publications/bestpractices/best%20practices%20sept%…) Positive Pay is a service that essentially requires bank customers to provide their bank with a list of checks that are to be paid, while payment is withheld for any checks that don't match the customer's list. The ACH Positive Pay service allows a customer to set parameters on payments. For instance, payments that occur regularly with similar amounts can be set up to pay automatically, while any payments that fall outside normal transactions will be suspended until authorized. Most banks offer Positive Pay and ACH Positive Pay for a fee. In CORSA's experience fees vary, but customers are able to significantly lower fees through negotiation. Should you have questions regarding Positive Pay or ACH Positive Pay contact Thisbe Butcher at tbutcher(a)ccao.org<mailto:tbutcher@ccao.org> [Chart depicting Reported Loss Associated with BEC/Cryptocurrency Complaints for the years of 2018, 2019, 2020, and 2021.] Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image002.png@01D8BD3E.0B6EC360] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 2

Cybercrimes Spike During the Holiday Season
by Frank Hatfield Dec. 11, 2024

Dec. 11, 2024

Cybercriminals work overtime on holidays and weekends. According to a recent report, ransomware attackers often strike when defenses are weakest—86% of study participants who experienced a ransomware attack were targeted on a weekend or holiday, when staffing is most likely to be reduced. Attached is the report. If you haven’t done so already done so put a plan to in place now to maintain maximum cybersecurity for your County and/or agencies. Below is a list of considerations with links to more information. As always, feel free t contact regarding CORSA loss control services and programs. We wish you a safe and secure holiday season. PREPARE FOR HOLIDAY CYBER ATTACKS: Attackers strike the most during holidays and weekends when companies are vulnerable and understaffed. ⚠️ Attacks are more common during non-business hours, mostly due to less staff available to protect the company. ⚠️ Large, profitable companies tend to be the main targets but small businesses with less protection are also a target. ⚠️The attacks that occur during non-business hours take longer to investigate and resolve, which may slow response and notification. Action Items Protect your organization with these practices: ✅ Review cyber incident response plans, resiliency plans, and communications plans. ✅ Reiterate cybersecurity user awareness and training program tips that include guidance on how to report incidents. ✅ Tune endpoint protection, regularly update, and enable real-time detection for antivirus software on all hosts. ✅ Make (and test restore) an offline backup of your data. ✅ Confirm multi-factor authentication (MFA) is working as intended for all services possible. ✅ Confirm software and operating systems are up to date to download the latest security patches. ✅ Scan for open and unused ports and remove any application not deemed necessary for day-to-day operations. ✅ Add an email banner to emails received from outside your organization to warn employees. More Information 🔒 FBI - Ransomware Awareness for Holidays and Weekends https://www.cisa.gov/uscert/ncas/alerts/aa21-243a 🔒 Why do cyber-attacks increase during holidays? - Security Boulevard https://securityboulevard.com/2022/12/why-do-cyber-attacks-increase-during-… https://www.linkedin.com/pulse/prepare-now-holiday-weekend-cyberattacks-ris… Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.” CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

account set up
by Jamie J. Arcaro Dec. 10, 2024

Dec. 10, 2024

I did not received the email to verify my email address when setting up an account. Can you please assist? Jamie J. Arcaro Ashtabula County Commissioners Workers' Compensation and Risk Specialist 25 West Jefferson Street Jefferson, OH 44047 Phone: 440-576-3748 Fax: 440-576-2344

1 0

Holiday Loss Control Tips
by Frank Hatfield Nov. 25, 2024

Nov. 25, 2024

The holiday season is here. We wish you a happy and safe season. Please take a moment to plan for a safe holiday season in the following three areas: 1. At your facilities; 2. In the cyber universe; and 3. on the roadway. Below and attached are general tips to assist with your preparation, with links to more information. As always, feel free to contact Jim Hale or myself regarding CORSA loss control resources. We wish you, your peers, friends and family a happy and safe holiday season. PREPAR FOR HOLIDAY CYBER ATTACKS: Attackers strike the most during holidays and weekends when companies are vulnerable and understaffed. ⚠️ Attacks are more common during non-business hours, mostly due to less staff available to protect the company. ⚠️ Large, profitable companies tend to be the main targets but small businesses with less protection are also a target. ⚠️The attacks that occur during non-business hours take longer to investigate and resolve, which may slow response and notification. Action Items Protect your organization with these practices: ✅ Review cyber incident response plans, resiliency plans, and communications plans. ✅ Reiterate cybersecurity user awareness and training program tips that include guidance on how to report incidents. ✅ Tune endpoint protection, regularly update, and enable real-time detection for antivirus software on all hosts. ✅ Make (and test restore) an offline backup of your data. ✅ Confirm multi-factor authentication (MFA) is working as intended for all services possible. ✅ Confirm software and operating systems are up to date to download the latest security patches. ✅ Scan for open and unused ports and remove any application not deemed necessary for day-to-day operations. ✅ Add an email banner to emails received from outside your organization to warn employees. More Information 🔒 FBI - Ransomware Awareness for Holidays and Weekends https://www.cisa.gov/uscert/ncas/alerts/aa21-243a 🔒 Why do cyber-attacks increase during holidays? - Security Boulevard https://securityboulevard.com/2022/12/why-do-cyber-attacks-increase-during-… https://www.linkedin.com/pulse/prepare-now-holiday-weekend-cyberattacks-ris… PREPARE FOR HOLIDAY TRAVEL ON AND OFF THE JOB More Than 502 People May Die in Preventable Traffic Crashes Over Thanksgiving https://www.prnewswire.com/news-releases/more-than-502-people-may-die-in-pr… National Safety Council urges all drivers to share the road responsibly by following these safety tips during this holiday season—and always: * Prepare before you go: Before hitting the road, make sure your car is safe for driving. Vehicle owners should check the oil, put air in the tires, and check for and repair open recalls. Visit ChecktoPrtect.org<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=181857447&u=https%3A%2F%2Fw…> to see if your vehicle has an open recall, and get it repaired for free. * Buckle up: Lack of seat belt use is a top cause of fatalities in crashes. Buckle up, while also making sure you have appropriate car seats installed correctly<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=3783644550&u=https%3A%2F%2F…>. * Designate a sober driver or arrange alternate transportation: Holidays are a cause for celebration, but alcohol is only one cause of impaired driving. Drugs, including opioids, marijuana and some over-the-counter medicines, can cause drowsiness, alter visual functions and affect mental judgment and motor skills. * Slow down: Speeding is a factor in more than a quarter of all traffic fatalities<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=795979627&u=https%3A%2F%2Fi…>. Drive the speed limit or below it if conditions dictate. Be sure to pay close attention to those walking and biking in order to keep all road users safe. * Drive distraction-free: Thousands have died in car crashes involving cell phone use. Put your phones away and #JustDrive. * Look before you lock: Pediatric vehicular heatstroke is still the leading cause of non-crash motor vehicle-related fatality for children. So far in 2023, 19 children in the U.S. are reported to have died<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=1235261407&u=https%3A%2F%2F…> because of this completely preventable tragedy. Always check your back seat for children or animals when you reach your destination. PREPARE FOR YOUR FACILITIES FOR THE HOLIDAYS See attached. Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.” CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0