Former CPA Sentenced to Prison for Laundering Millions Stolen from Children's Healthcare of Atlanta

A former Certified Public Accountant has been sentenced to four years in federal prison after helping launder millions of dollars stolen from one of Georgia's leading paediatric healthcare providers through a sophisticated business email compromise scheme. The case highlights the growing threat posed by cyber-enabled financial fraud targeting healthcare organisations and demonstrates how individuals with financial expertise can play a critical role in facilitating the movement of illicit proceeds after an initial cyberattack.

According to the U.S. Attorney's Office for the Northern District of Georgia, Ronald Deabler, a 66-year-old Atlanta business owner and former CPA, was convicted of conspiring to launder approximately $5.3 million that had been fraudulently diverted from Children's Healthcare of Atlanta (CHOA). The federal court sentenced Deabler to four years' imprisonment, to be followed by two years of supervised release. He was also ordered to pay restitution amounting to $682,860 after authorities successfully recovered a substantial portion of the stolen funds during the investigation.

Federal prosecutors said the scheme originated in early June 2023 when an unidentified hacker gained unauthorised access to the email account of a commercial furniture vendor that conducted business with Children's Healthcare of Atlanta. Using the compromised account, the attacker impersonated a legitimate vendor employee and instructed the hospital to update the banking information used for Automated Clearing House (ACH) payments. Instead of directing payments to the vendor's legitimate account, the revised banking details pointed to an account controlled by Deabler.

Believing the instructions to be genuine, Children's Healthcare of Atlanta transferred approximately $5.3 million on or around 13 June 2023 into the fraudulent account. Investigators determined that Deabler had agreed to receive and distribute the stolen funds in exchange for a commission, effectively acting as a money laundering facilitator for the cybercriminal behind the scheme.

Shortly after the funds arrived, Deabler attempted to move the full amount into a newly opened bank account under his control. When banking controls prevented the transfer of the entire balance, he instead succeeded in transferring more than $1 million into the second account. He subsequently converted approximately $3.5 million into four cashier's cheques, which he mailed to various individuals and entities in accordance with instructions received from the hacker. The movement of funds through multiple accounts and payment instruments was intended to obscure the origin of the stolen money and complicate recovery efforts.

The fraud was identified within days after the payment was made. Children's Healthcare of Atlanta and its vendor detected irregularities in the transaction and promptly alerted the hospital's financial institution. The bank traced the transferred funds to Deabler's accounts, allowing investigators to follow the subsequent movement of the money. Through coordinated tracing efforts, law enforcement authorities recovered approximately $4 million from Deabler's accounts and from other accounts that had received the cashier's cheques before the remaining proceeds could be dispersed further.

Following a jury trial, Deabler was found guilty on 12 February 2026 of conspiracy to commit money laundering. The sentencing, handed down on 22 July 2026, concluded a federal prosecution led by the U.S. Attorney's Office, with the Federal Bureau of Investigation conducting the criminal investigation.

Federal officials emphasised that healthcare institutions remain attractive targets for increasingly sophisticated cybercriminals seeking to exploit payment systems and vendor relationships. Authorities also stressed that individuals who knowingly assist in concealing or distributing fraud proceeds, regardless of whether they carried out the original cyber intrusion, face significant criminal liability under U.S. money laundering laws. The case demonstrates the importance of strong payment verification procedures, vendor authentication controls and rapid incident reporting to maximise the likelihood of recovering stolen assets before they disappear through complex laundering networks.

By fLEXI tEAM