Surfside Beach officials say the town’s insurance carrier will not pick up the tab after a cyber-enabled diversion rerouted roughly $545,600 that was supposed to reimburse an underground-utility contractor earlier this spring. The money never landed in the contractor’s account, and the town is now waiting on an independent forensic audit while state and federal investigators track the missing funds.
In a May 22 news release, the Town of Surfside Beach said staff discovered the diversion on April 27 and immediately turned the case over to the South Carolina Law Enforcement Division, which then pulled in the FBI. Investigators are focused on following the money trail, figuring out how the diversion was pulled off, and whether any of the cash can be clawed back.
The town’s insurer, Great American Insurance Group, has declined to cover legal fees tied to the contractor’s demand for payment and will not cover third-party claims for money allegedly owed, according to WFXB. That leaves Surfside Beach financially exposed unless investigators recover some of the funds or the insurer has a change of heart.
How the diversion happened
Town records show a $545,598.30 ACH payment was initiated on March 13 for work completed by Wildcat, a Gastonia-based contractor. Wildcat says the money never showed up and notes it has historically been paid only by check, according to WMBF. Both the contractor and investigators say confirmation emails tied to the transfer were riddled with warning signs, including a misspelled address and what appeared to be a forged signature, and law enforcement has described the case as part of a broader scheme targeting government payments.
Why insurers sometimes balk
Cities and counties are finding out the hard way that not all cyber policies are created equal. Coverage for cyber losses can vary widely, and many policies carve out or sharply limit payouts for social-engineering or business-email-compromise incidents. Policy language from Great American Insurance Group and prior litigation involving the carrier, reported by Law360, show that fights over whether diverted funds are covered can end up in court. In some cases, insurers have successfully avoided paying, leaving municipalities to chase recovery through banks, law enforcement, or civil suits instead.
Town tightening payment controls
Surfside Beach officials say they are shoring up internal controls around contractor payments in the wake of the incident, according to the town’s May statement. Those changes include new forms that require precise payment instructions and an exploration of expanded cybersecurity training for staff. At the same time, officials say forensic specialists and banks are still working behind the scenes to trace the money while the town updates its procedures to lower the odds of another diversion.
Contractor still unpaid
The contractor, identified in public records as Wildcat of Gastonia, says it has not received the $545,598.30 and has not been contacted by town attorneys about getting paid, according to reporting from The Sun News. The company says it realized something was off when the town reported making the ACH transfer, then spotted the suspect confirmation emails that did not match its normal payment arrangements…