WENATCHEE — Hackers stole more than $1 million from an electronic bank account held by Cascade Medical Center in Leavenworth, leading to a multi-state criminal investigation that could yield federal charges.
On Monday morning, Chelan County Treasurer David Griffiths’ office noticed three unauthorized transaction files that had been logged the previous Friday. The files moved an estimated $1.03 million out of the public hospital district’s ACH account to 96 different bank accounts, most of them in the Midwest and East Coast.
By notifying the recipient banks, the treasurer’s office has been able to retrieve about $133,000 of the lost funds, Griffiths said Friday. The process is ongoing, and it may take at least 30 days to learn how much money was lost and how much can be recovered.
“We are proactive in this,” Griffiths said. “We’re not only in a heightened alert because of the situation, we’re also taking measures to add even greater security precautions.”
Automated Clearing House accounts are used by public and private entities for direct-deposit payroll and bill payment. By law, the treasurer administrates such assets for 55 junior taxing districts in Chelan County, including Leavenworth’s Chelan County Public Hospital District No. 1.
ACH accounts are reviewed and balanced on a 24-hour cycle each business day, but the weekend might have left the hackers time to remove stolen money before the theft was noticed Monday. The nearest recipient account was located in Utah, Griffiths said.
The ACH accounts for such subdistricts are operated outside the county’s own finance system, Griffiths said. No county funds were affected in the cyberattack, which he called “sophisticated,” but he said his office is reviewing other districts’ transactions carefully.
“If there was access in the case where one junior taxing district got hacked, our natural assumption would be that any one of the other districts could have been hacked.”
The transfers of cash across state lines makes the crime subject to federal investigation and prosecution. The Chelan County Sheriff’s Office is investigating locally, and Griffiths is cooperating with interstate fraud investigators.
“This is really not pleasant — not so much for us, but particularly for the hospital district,” Griffiths said. “… I feel really bad that the public hospital district has had to find themselves in the limelight like this.”
Cascade Medical Center executive director Diane Blake could not be reached by phone Friday morning. The nonprofit hospital has a $13.2 million budget, about $8 million of it dedicated to salaries and benefits, according to its 2012 report to the state Department of Health. In 2011 it completed a $14 million remodel, financed in part by an $8 million bond initiative.
Jefferson Robbins: 664-7123