A former certified public accountant has been sentenced to four years in federal prison for laundering more than $5.3 million stolen from Children’s Healthcare of Atlanta through a business email compromise scheme.
Ronald Deabler, a 66-year-old Atlanta business owner, was convicted by a jury earlier this year for his role in the scheme. According to court documents, an unidentified hacker gained access to the email system of one of Children’s Healthcare of Atlanta’s furniture vendors. The attacker then impersonated a vendor employee and tricked the pediatric health system into wiring $5.3 million to a bank account controlled by Deabler.
Deabler used his knowledge of the banking system to distribute the stolen funds, prosecutors said. The sentencing was announced by the U.S. Attorney’s Office, which noted that the scheme targeted a nonprofit pediatric healthcare system dedicated to the welfare of Georgia’s infants, children, and teens.
Business email compromise attacks remain a significant threat to healthcare organizations, which often process large payments to vendors and suppliers. The FBI has repeatedly warned that BEC schemes targeting the healthcare sector are increasing, with losses totaling billions of dollars annually. Healthcare CISOs should review vendor payment verification processes and implement multi-factor authentication on email systems as critical controls against this attack vector.
