A Former CPA Laundered $5.3M From A Children's Hospital

A hacker changed one payment instruction. Then $5.3 million meant for a children's hospital landed in a former CPA's bank account. The bank stopped part of the cleanup, but not before millions moved again.

One Fake Vendor Email Moved The Money

This started with the kind of fraud that looks boring until the wire leaves.

An unknown hacker got into the email system of a commercial furniture vendor that worked with Children's Healthcare of Atlanta. The hacker pretended to be a vendor employee and asked the hospital to update the vendor's bank details.

The new account belonged to Ronald Deabler, an Atlanta business owner who was then a certified public accountant. On June 13, 2023, the hospital wired $5.3 million into that account.

That is the nightmare version of accounts payable. One vendor file changes. One big payment moves. Then everyone finds out the control was not strong enough.

The Bank Stopped One Move. Millions Still Left.

Deabler was convicted by a federal jury in February for helping launder the stolen money. He was sentenced Wednesday to four years in prison, followed by two years of supervised release, and ordered to pay $682,860 in restitution.

After the money hit his account, prosecutors said he opened a second bank account and tried to move the full $5.3 million into it. The bank blocked that full transfer.

But more than $1 million still moved into the new account. Deabler also converted about $3.5 million into four cashier's checks and mailed them out as directed by the hacker.

Investigators later recovered about $4 million from Deabler's accounts and from bank accounts that received the checks. The rest of the money trail is still the ugly part.

The Accounting Lesson Is Painfully Simple

This is not just a cyber story. It is an accounting controls story wearing a cyber mask.

The weak point was not a fancy hack inside the hospital's general ledger. It was a vendor payment change that looked real enough to pass. That is where finance teams get hurt.

Large vendor bank changes need an out-of-band callback to a known contact, not the email thread asking for the change. They need a second approver. They need a payment hold if the wire is big enough to ruin everyone's week.

The boring checklist is the whole game here. Verify the vendor. Verify the bank. Verify the person asking. Then document who approved it before the money moves.

A CPA Title Makes The Story Worse

The part that stings is not only the hospital loss. It is that a former CPA helped move the money after it landed.

The U.S. Attorney said Deabler used his knowledge of the banking system to launder money stolen from a nonprofit pediatric healthcare system. That is exactly why the profession cares. Trust is the product.

When a client asks why a vendor bank change needs another call, this is the answer. Nobody wants the extra step until the extra step is the only thing between a payment run and federal court.