A 2024 Kroll review found gaps in Hoover's IT safeguards, but the city says Mayor Nick Derzis and the council were not told of it. Here is what it found and what has changed.
A second report by the consulting firm Kroll found serious gaps in the safeguards on Hoover’s computer systems. The city says the report was never shown to Mayor Nick Derzis, his transition team or the City Council.
The City of Hoover made the report public in a release on Monday, Oct. 26. Derzis presented it to the council at its meeting that night.
The report is dated July 26, 2024. The city said it was commissioned under the previous administration. Derzis took office in November 2025.
What the report found
The report is titled IT Pre-Assessment Audit. Kroll wrote it after an on-site look at the city’s technology operations in May 2024, the city said.
The review was prompted in part by missing records. Financial documents from earlier years could not be found on city servers, in email accounts or in paper files. The city’s IT Department could not recover some of them from its backups.
Kroll examined 16 areas of the city’s technology operations. It found many weaknesses that needed fixing before the city would be ready for a full IT audit, the city said.
Kroll’s recommendations included:
- formal cybersecurity risk assessments
- incident response and disaster recovery plans
- plans to keep services running during an emergency
- better documentation of city systems
- updated technology settings
- tighter control over who can use the city’s financial software
The city said its systems lacked safeguards to protect government information, recover missing records and keep essential services running during a cyberattack.
The release does not link to the report. The city said it fixed the weak points first, before disclosing details that could expose its systems to more threats.
The release also does not say who in the previous administration knew about the report or why it was not passed on.
How it links to the first Kroll review
Kroll’s first review was public. It was a forensic accounting review of city finances from October 2020 through September 2023.
That review found no specific evidence of fraud or misuse of public money, the city said. But it found weak financial controls, poor recordkeeping, incomplete reconciliations and errors in setting up the city’s financial software. Kroll warned the weaknesses could create “an opportunity to commit financial fraud.”
“Learning that a second Kroll report had identified serious vulnerabilities in our information systems, and that those findings had not been disclosed to us during the transition, was deeply concerning,” Derzis said in the release.
What the state examiners said
On Sept. 14, the council passed a resolution on questions the first review left open. It let Derzis and Council President Casey Middlebrooks ask the Alabama Department of Examiners of Public Accounts to look at some city receipts and spending from past years.
Chief Examiner Rachel Riddle answered Oct. 15, the city said. Her department found no new information suggesting fraud or financial mismanagement that would justify an audit.
Council member Robin Schultz, who the city said has worked in cybersecurity for 25 years, helped coordinate the review.
“In many respects, it was like discovering that the bank vault had been left open. The fact that no theft was identified doesn’t make the lack of security any less serious,” Schultz said in the release.
What the city has done since
Hoover joined the Alabama State and Local Cybersecurity Grant Program, run through the Alabama Office of Information Technology. Through it, Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security is assessing the city’s systems.
The city said it has received more than $600,000 in new hardware and network equipment through the program. It also gets cybersecurity services and technical help. The McCrary Institute said the program comes at no cost to local taxpayers.
Derzis also set up a team of city finance and technology staff, the city attorney, a council member and an outside technology adviser.
In the Finance Department, Chief Financial Officer Melinda Lopez was told to tighten controls. The city listed these changes:
- more consistent budget amendment procedures and better documentation
- updated purchasing policies, including rules for federally funded purchases
- more staff training and cross-training
- written procedures and better sharing of financial information between departments
- a continuing review of the city’s financial management software
The city also finished its audit for the 2025 fiscal year, a process of about seven and a half months. Lopez reported finding no evidence of financial misconduct, the city said.
What it means for you
- No money is reported missing. Neither Kroll review found specific evidence of fraud, and the state examiners found no new sign of it, according to the city.
- No breach has been reported. The report described weak safeguards, not an attack. The city has not said any resident data was exposed.
- The new equipment came through a state grant program. The city said it received more than $600,000 in hardware and network equipment; the McCrary Institute said the program is at no cost to local taxpayers.
- You can watch the presentation. Derzis and Lopez spoke to the council Oct. 26. The meeting video starts at about 30 minutes, as linked in the city’s summary of the meeting.
For how city taxes work, see our guide to Hoover property taxes. For who handles what at the Municipal Center, see who to call at City Hall.
Have your say