Mayor Nick Derzis said Monday that a second outside audit found Hoover could not locate financial records from prior years or recover them from backups, and former Mayor Frank Brocato’s administration never disclosed the report to the City Council or the incoming administration.
“Learning that a second Kroll report had identified serious vulnerabilities in our information systems, and that those findings had not been disclosed to us during the transition, was deeply concerning,” Derzis said.
The first report, a forensic accounting review of city finances from October 2020 through September 2023 by Kroll, a New York-based forensic accounting and investigations firm the city’s attorneys hired in April 2024, was released publicly in September 2024.
Brocato said at the time the review left Hoover “in the best position to move forward.”
The second report, titled “IT Pre-Assessment Audit,” is dated July 26, 2024. Kroll prepared it after an on-site examination of Hoover’s technology operations in May 2024.
The city said the review was prompted in part by the discovery that financial documents from prior years could not be found on city servers, in email accounts or in physical records, and that the IT Department could not pull them from existing backups.
Kroll examined 16 areas of city technology and recommended formal cybersecurity risk assessments, incident response and disaster recovery plans, and stronger controls over who could access the city’s financial software.
Derzis, Hoover’s police chief for 20 years, announced against Brocato in March 2025 and beat him in August with 56% of the vote. He took office in November.
On September 14, the City Council voted to ask the Alabama Department of Examiners of Public Accounts to review the receipts and expenditures Kroll could not resolve. Chief Examiner Rachel Riddle responded on October 15 that her department had not found new information suggesting fraud or mismanagement that would warrant an audit.
Councilor Robin Schultz, a 25-year cybersecurity specialist who campaigned on a state audit of city finances, helped coordinate the review.
“In many respects, it was like discovering that the bank vault had been left open,” Schultz said. “The fact that no theft was identified doesn’t make the lack of security any less serious. You secure the vault, strengthen the controls, and make sure it cannot happen again.”
Council President Casey Middlebrooks said Derzis brought the report to the Council as soon as he found it.
“From the beginning, the Mayor informed the Council about the discovery of this unknown report and kept us involved throughout,” Middlebrooks said.
The city has since enrolled in the Alabama State and Local Cybersecurity Grant Program and is working with Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security. Hoover has received more than $600,000 in hardware and network equipment through the program.
“We inherited serious problems, and it is our responsibility to address them thoroughly and openly,” Derzis said. “We have brought in outside experts, strengthened financial controls, and secured significant technological resources, so that our citizens can be confident that their City is protected.”
Grayson Everett is the editor in chief of Yellowhammer News. You can follow him on X @Grayson270.
