BRUNSWICK, Ohio – Email hackers stole $1.75 million from St. Ambrose Catholic Parish in Brunswick, the church said in a letter to parishioners.
The FBI determined hackers tricked St. Ambrose into believing that the construction firm it is working with to repair and restore the church changed its bank account. The hackers deceived St. Ambrose into wiring the money to a fraudulent bank account, Father Bob Stec said in the letter.
The hacker then moved the money out of the fraudulent bank account “before anyone knew what had happened,” Stec said in the letter.
The full letter can be read at the bottom of this post.
Stec said the hackers accessed two St. Ambrose employees’ email accounts. He did not say how the hackers accessed those accounts.
St. Ambrose discovered the theft April 17, after Marous Brothers Construction contacted the church to ask why it had not paid two recent bills totaling $1.75 million. The bills are related to the church’s Vision 2020 project, which aims to raise $4 million to repair and restore St. Ambrose.
“We are working closely with the Diocese and its insurance program to file a claim in the hopes that Marous Brothers Construction can receive their payment quickly and we can bring this important project for our parish to a positive completion,” Stec said in the letter.
St. Ambrose already works with an IT consultant, but the church will be hiring another firm to perform a review of its internet security, Stec said.
The church determined that only its email accounts were hacked. No other information – including parishioner databases, or financial information for the church’s automatic giving program – was compromised, Stec said.
“Please know how very sorry I am that this has occurred in our parish community,” Stec said in the letter to parishioners. “If I/we had any idea, any clue, any information that the money was not being sent to the right account, we would have addressed it immediately.”
To comment on this story, visit Monday’s crime and courts comments page.