Hoover Officials Say Brocato Withheld Cyber Audit From Council

Hoover's mayor and council officials issued a joint statement this week disputing former Mayor Frank Brocato's account of how a 2024 cybersecurity audit was handled, calling his version "a distorted and purposely misleading version of the events that have transpired over the past two years."

The dispute centers on a Kroll "IT Pre-Assessment Audit" delivered to the Brocato administration in July 2024. The document found that Hoover's technology systems lacked basic safeguards against a cyberattack. Mayor Nick Derzis disclosed the report's existence to the City Council on Monday night and said neither the council nor his transition team had been told about it.

Derzis defeated Brocato in August 2025 with 55.5% of the vote after a campaign built around a separate Kroll report concerning the city's finances. A majority of the council endorsed Derzis over the incumbent. One councilor, a cybersecurity professional by trade, described the vulnerability as "discovering that the bank vault had been left open."

Brocato said he informed Derzis, then police chief, and the City Council when financial and IT concerns were identified. He said his CFO and treasurer met with Derzis and transition chairman Michael Davis before the inauguration and handed over the Kroll IT draft on a thumb drive. "There is a fundamental difference between concealing information and protecting sensitive cybersecurity information," Brocato said.

City Hall offered a different account of that handoff. The joint statement said the two employees "said they were acting on their own" and "feared reprisal." The statement added: "Mr. Brocato now presents that handoff as his administration's disclosure. It was nothing of the kind." The city also said there was no meeting and no briefing from Brocato between the August 26 election and the November 3 swearing-in, and that his contribution to the transition was a congratulatory letter.

Council President Casey Middlebrooks, who served on the council throughout the Brocato administration, said he had no knowledge of any Kroll IT assessment until City Attorney Charlie Waldrep told him after the inauguration. "The Council has oversight responsibility, and protecting information from the public is different from informing the elected body charged with governing the City," Middlebrooks said. Councilor Steve McClinton said he learned of the report after Derzis took office: "Keeping the Council in the dark wasn't a mistake Frank made once; it was a hallmark."

Derzis said the first he heard of the Kroll IT report was when two city employees brought it to his attention less than two weeks before he took office, and that he did not send them. He also pointed to the state's State and Local Cybersecurity Grant Program, under which Hoover qualified for more than $600,000 in equipment and services. "A city does not qualify for equipment funding through the State and Local Cybersecurity Grant Program unless its systems are deemed to be deficient," Derzis said. Brocato said a telephone call between the two men could have addressed the matters "without the public accusations and attacks on my integrity."

Derzis said the Hoover Sun published Brocato's claims "without a single inquiry to me, my transition team, or any member of the City Council."