Things are heating up in Hoover.
Frank Brocato, who served as Mayor of Hoover for nine years, responded in closing to current Mayor Nick Derzis going wide with claims that his administration mishandled major city cybersecurity vulnerabilities with the statement, “I will not engage in further political attacks.”
In response, Hoover City Hall kept swinging.
The city put out a rebuttal, all signed onto by the mayor, the city council president and a council member, describing Brocato’s account of the situation as “a distorted and purposely misleading version of the events that have transpired over the past two years.”
And it only got nastier from there.
The dispute is over the existence of a second Kroll report. The firm that conducted the forensic review of Hoover’s finances also delivered an “IT Pre-Assessment Audit” to the Brocato administration in July 2024, finding the city’s technology systems lacked basic safeguards against a cyberattack.
Mayor Nick Derzis disclosed the report’s existence to the City Council on Monday night and said neither the council nor his transition team had been told about it.
One councilor, a cybersecurity professional by trade, likened the vulnerability to, “discovering that the bank vault had been left open.”
Derzis, Hoover’s longtime police chief, defeated Brocato in August 2025 with 55.5% of the vote after a campaign built around the first Kroll report. A majority of the council endorsed him over the incumbent.
Derzis told the council nobody in the old administration ever mentioned a second Kroll report.
Brocato’s defense, in his words:
“When financial accounting and IT concerns were identified, I immediately informed then-Police Chief Nick Derzis and the City Council.”
He says his CFO and treasurer met with Derzis and transition chairman Michael Davis before the inauguration and handed over the Kroll IT draft on a thumb drive, and that everything was handled responsibly.
“There is a fundamental difference between concealing information and protecting sensitive cybersecurity information. My responsibility was to protect the city of Hoover, and that is exactly what I did,” Brocato said.
The city had a very different memory of that thumb drive.
By City Hall’s telling, the two employees “said they were acting on their own. They said they feared reprisal. Mr. Brocato now presents that handoff as his administration’s disclosure. It was nothing of the kind. He is attempting to take credit for the actions of two individuals who had the courage to do what he lacked the decency to do himself.”
As for the broader transition, the city tallied it up: from the August 26 election to the November 3 swearing-in, “there was no meeting with the former mayor and no briefing from him. Not one. His entire contribution to the transition was a congratulatory letter.”
Then came the people who sat in the room with Brocato for years.
Council President Casey Middlebrooks served on the council throughout the Brocato administration and tried to keep it cordial.
“I appreciate Frank Brocato’s service and have no ill will toward him. But until City Attorney Charlie Waldrep informed me after the inauguration, I had no knowledge that Kroll had done any assessment of our IT, formal or informal, and no knowledge of the vulnerabilities it found,” Middlebrooks said. “The Council has oversight responsibility, and protecting information from the public is different from informing the elected body charged with governing the City.”
Councilor Steve McClinton, another holdover from the Brocato years, did not bother with cordial.
“The former mayor says the Council was briefed. We were, after Mayor Derzis took office,” McClinton said. “Keeping the Council in the dark wasn’t a mistake Frank made once; it was a hallmark. A majority of this Council endorsed Mayor Derzis because we were done being the last to receive information.”
Derzis took on Brocato’s claim that the then-police chief “led the investigation” and knew what Kroll had found.
“The only investigation I took part in as police chief concerned the City’s finances, which were detailed in the Kroll financial report,” Derzis said. “The first I heard of the Kroll IT report was when two City employees brought it to my attention, less than two weeks before I took office. The former mayor did not send them. These employees told me they feared reprisal.”
Brocato maintains the problems were corrected before he left office. Derzis pointed to the state’s checkbook.
“A city does not qualify for equipment funding through the State and Local Cybersecurity Grant Program unless its systems are deemed to be deficient,” Derzis said. “Hoover qualified for more than $600,000 in equipment and services. That support comes at no cost to our taxpayers. We will continue these efforts until the job is done.”
Brocato, for his part, ended his statement wishing the whole thing had stayed between two old friends.
“A simple telephone call between friends who have worked together for 50 years could have addressed many of these matters without the public accusations and attacks on my integrity,” Brocato said.
Derzis was not in a phone-call mood.
“Mr. Brocato can keep attempting to whitewash his past inaction,” Derzis said. “We are busy fixing the problems he failed to address.”
The Hoover Sun caught a stray on the way out as well.
Derzis said the paper published Brocato’s claims “without a single inquiry to me, my transition team, or any member of the City Council.”
Grayson Everett is the editor in chief of Yellowhammer News. You can follow him on X @Grayson270.
