Message from the Executive Director: I Was Hacked! Lessons Learned
GBA Executive Director Joel Carson
On Wednesday, July 17, I received a call from a GBA Board Member asking
if I was trying to send him a proposal. While this seemed suspicious, I just told him it must be a phishing effort and asked him to disregard the email.
That was the start of an onslaught of emails, text messages, and phone calls from friends and colleagues from across North America. It quickly became apparent that my Microsoft Outlook account had been hacked and I became very concerned, very quickly. I thought about worst case scenarios and started sweating.
Here are the steps I took to overcome this significant issue.
SECURE ACCOUNT
I quickly contacted GBA’s IT consultant who thankfully is always quick to respond, even though today he was in an important meeting. He stepped out of his meeting and immediately started working with me to resolve the issue and it was not simple. It was determined that the hacker accessed my email server through my Google account and was sending out notices asking my contacts to open a proposal. Additionally, when my contacts responded by email asking if the proposal request was legitimate, the hacker responded giving a false sense of security! This is a new and sophisticated approach to hacking that I had not heard of but something we should all be aware of now.
We tried to reset my Microsoft password but it was challenging because my authenticator app had been compromised as well. After clearing select apps and setting up my email account, the issue was resolved, resecuring my account and updating my authenticator. Although I felt some relief, the work was not done.
RESPOND TO INQUIRIES
I started responding to emails and text messages about this issue. In some cases, the messages were simply to let me know something was suspicious and in other cases my contacts were asking me to send the proposal in different formats as they had followed the hacker’s instructions, provided their account information, and still could not see my proposal.
PROACTIVELY COMMUNICATE
I also asked our IT consultant for a list of all the emails that had been sent from my account since the previous day. I felt it important to let everyone know about this issue so I sent an email to each of them. I apologized, explained the situation, confirmed we take cybersecurity seriously, and provided suggestions to manage the risk.
I received numerous email responses which helped ease the stress. Our members are compassionate and supportive.
LESSONS LEARNED
Consistent with our members Case Histories, I compiled a list of lessons I learned during the day.
1. If there is an issue with your computer or suspect it has been compromised, don’t hesitate. Contact your IT support immediately and let your colleagues know.
2. If you receive a suspicious email do not open it.
3. If you think an email is suspicious but need to double-check, don’t send an email on the same format asking if it is legitimate. Call or text the person. It is important to use a different communication method to verify legitimacy.
4. When you have an issue, let anyone that could be impacted know. Start with an apology, be clear about the issue, confirm the issue is resolved, provide suggestions on ways to manage risk, and end with an apology. Transparency is critical.
5. GBA Members and our business partners are awesome. They are understanding, compassionate, and supportive. I already knew this, but the points were emphasized on this day.
CLOSING
One of the things I most appreciate about GBA is the mutual support of our members through good times and through challenging times. I see this in Committee Meetings, Peer Groups, and regular communication among our members. I witnessed this firsthand. Another thing I appreciate about GBA members is our willingness to share experiences with each other so we can all learn together and elevate our profession together. In part, I was prompted to prepare this lesson learned in response to the sharing I observe each day as Director and this is why GBA Case Histories are so important.
If you have other best practices to share about computer security or technology in general, please let me know. I appreciate your support and willingness to elevate our profession.
documents to the new platform and test the new system, there may be some unexpected gaps in access to member benefits and our library of resources.
GBA’s 
that have happened to geoprofessional firms. GBA Case Histories are unique
there is an opportunity to highlight your expertise to the best and most effective geoprofessional firms in the industry at GBA’s 2025 Fall Conference, April 24-26 in Savannah, Georgia. Sponsorship of the 2025 Annual Conference gives businesses the opportunity to maximize brand awareness, increase visibility, and reinforce their reputation.
“We found the GBA community at least as smart, warm, and eager as we knew to expect and the conference program was one of the very best I have experienced,” said Rachel Hile-Broad,Performance Consultant at the Hile Group, a sponsor of GBA’s 2024 Annual Conference. “The return on time, energy, financial) investment could hardly be clearer and the Hile Group is looking forward to make GBA a professional home.”
staff and their business,” said David Gagne, CEO of Metafield by Agile Frameworks, a sponsor of GBA’s 2024 Annual Conference. “These events allow us to hear from and engage with our market first-hand. The value GBA provides to the industry through addressing industry challenges and bringing people together is worth investing in!”
efficiency, and curiosity. GBA’s Business Technology Committee is producing a six-part series to educate GBA members on the implications of AI on the geoprofessions. The articles, written by Enrique Farfan, Ph.D., P.E. ENV SP (HDR), explore how this technology works and its potential uses.
(Sanborn, Head, & Associates Inc.), has been selected as the recipient of this year’s Professional Practice Ethics & Leadership award, presented jointly by GBA and the American Society of Civil Engineers. This award honors the accomplishments of a licensed professional engineer who displays outstanding engineering ethics and leadership.
“Throughout my career, I’m constantly amazed at the dedication of the professionals that I meet and work with,” Head said. “Their passion for what they do and the commitment to always doing the right thing has been inspiring. I can’t think of a richer or more rewarding career.”
My peers – including many GBA leaders – have made the defining difference in my career.”
May begins the new business year for GBA. In GBA’s long history we’ve had 54 prior Presidents including some of the iconic figures in our industry, each trying to lead the organization for current and future relevance in delivering for our member firms. Through the years, GBA has been driven and nimble in tackling the big business issues we all faced including finding viable professional liability insurance, risk management best practices, as well as business optimization including leadership and ownership transition, commoditization, and most recently recruiting.
Leo Titus, P.E. (ECS Group of Companies), and Matt Moler, P.E. (S&ME) we largely completed the goals of our prior 
These circumstances are best addressed together in a group, as no one single individual or organization has a broad enough perspective to do so. It’s in these situations that GBA has excelled because of our nimble size, trusting peer to peer relationships for sharing best practices. and a tradition of not hiding from the hard things.
feel free to reach out to me at 
requirements for initial curing of concrete test specimens in the field, requiring the contractor to “provide space and source of electrical power on the project site for facilities to be used for initial curing of concrete test specimens as required by ASTM C31/C31M, for the sole use of the Owner’s quality assurance testing agency.” Does “space” mean that the contractor must set aside an area at the construction site where the construction materials engineering and testing (CoMET) consultant or some other party will place or construct initial curing facilities? Or does “space” mean “an environmentally controlled space” for initial curing in the field?
discuss engagement strategies, inspiring students to join the profession, driving innovation, curiosity as the ultimate competitive advantage, overcoming challenges, and more.
continues to drive innovation, efficiency, and curiosity. GBA’s Business Technology Committee is producing a six-part series to educate GBA members on the implications of AI on the geoprofessions. The articles, written by Enrique Farfan, Ph.D., P.E. ENV SP (HDR), explore how this technology works and its potential uses.