For any modern small business, trusting an outside IT provider is a leap of faith. As with any other professional, many times they’re not just doing something you don’t “want” to do, but providing a service you may not fully understand. Overcoming that mistrust is difficult, especially for independent funeral homes. You want to keep your business dealings as local as possible, hoping that at least you “know” the person better than, say, someone who you can only interact with remotely. Unfortunately, all thieves live somewhere, so some of them probably live by you. A Connecticut funeral home found that out the hard way a few years ago, when their IT service turned out to be a double scam, charging them for things they didn’t need and then siphoning cash from their accounts.
The case of Billie Conley Jr., the IT contractor recently sentenced in federal court to nine months in prison for wire fraud, offers a sobering look at the digital vulnerabilities facing independent funeral homes. Court documents and federal prosecutors revealed that Conley used his Stratford- and Shelton-based firm, Ridgefield Tech, LLC, to exploit a local funeral home after being hired to install a new computer network and video surveillance system.
What appeared to be a standard vendor relationship quickly soured into extortion. According to the U.S. Attorney’s Office for the District of Connecticut, Conley secretly installed unauthorized remote-access software during the initial setup. Shortly after, the funeral home began experiencing recurring network outages and service failures. Every time the system crashed, the business owner was forced to call Conley back and pay out-of-pocket for service visits.
Red Flags, Sabotage, and $55,000 in Damages
This was the first of the red flags, especially after Conley attempted to lock the business into a recurring monthly IT support contract. According to reports, when the funeral home owner declined to pay what in retrospect looks like protection money, things got nasty. Between January and September 2024, federal investigators found that Conley remotely disabled the company’s computer network on 21 separate days, grinding daily operations, client coordination, and administrative scheduling to a halt.
The disruptions were severe enough to halt business entirely on multiple occasions. Desperate for a solution, the funeral home eventually brought in a second IT firm. Only then was the sabotage uncovered; the incoming technicians discovered that Conley had embedded deep, unauthorized access points into the infrastructure, making it impossible to regain control without starting from scratch. The funeral home was ultimately forced to spend roughly $46,000 on new hardware and emergency labor to rebuild its systems.
Ouch.
Beyond the digital sabotage, investigators discovered that Conley had illegally dipped into the funeral home’s bank accounts, skimming a little more than $9,000 between June and August 2024 to settle debts with third-party vendors and pay his personal cell phone bills.
Safeguarding Your Firm: Vetting and Internal Controls
For a funeral home handling sensitive client data, coordinating tight timelines, and maintaining continuous communication are critical. This case underscores a vital operational warning: trust but verify. Security experts say that independent establishments should regularly audit administrative access, restrict third-party vendors to monitored, least-privilege permissions, and maintain independent oversight of financial transactions to ensure that the people hired to secure a business are not the ones compromising it.
Evaluating and vetting an IT service provider is one of the most critical risk-management decisions a small business owner can make. Incidents like the federal case involving Ridgefield Tech highlight how vulnerability often stems from placing blind trust in a single vendor without structural safeguards or independent oversight.
Vetting an IT company before engaging them is critical. Beyond the basics, references in and around the community, business owners should see how long the company has been active, verify its physical addresses, and check for professional certifications. For providers handling sensitive administrative networks, video surveillance, and financial systems, business owners should also ask for formal proof of business insurance, bonding, and clear corporate accountability.
That’s the easy part. Once you’ve hired someone, it still makes sense to install strict internal controls. Ensure the IT provider does not have unrestricted, master administrator access to everything by default. Critical accounts like payroll, vital statistics portals, etc. should remain under direct proprietor control, with IT granted access only on an as-needed, logged basis.
Make sure as part of your deal that any software used for troubleshooting is explicitly disclosed, documented, and approved. If an IT vendor installs hidden background utilities or unapproved remote-desktop tools that cannot be easily monitored or disabled, that’s a problem for sure. Legitimate IT partners provide detailed ticket logs, explain what caused a failure, and offer permanent fixes rather than temporary band-aids.
Finally, and this was the action that caught Conley before he emptied out the business’ bank accounts, consider having a secondary, objective IT firm conduct a one-time security and network audit every year or two. An outside set of eyes can quickly spot unauthorized backdoors, hidden remote-access scripts, or lingering vulnerabilities left behind by current or past vendors.
When the IT Guy Sabotages the Business: Federal Case Highlights Cyber Vulnerabilities for Funeral Homes
By Tony Russo
For any modern small business, trusting an outside IT provider is a leap of faith. As with any other professional, many times they’re not just doing something you don’t “want” to do, but providing a service you may not fully understand. Overcoming that mistrust is difficult, especially for independent funeral homes. You want to keep your business dealings as local as possible, hoping that at least you “know” the person better than, say, someone who you can only interact with remotely. Unfortunately, all theives live somewhere, so some of them probably live by you. A Connecticut funeral home found that out the hard way a few years ago, when their IT service turned out to be a double scam, charging them for things they didn’t need and then ciphoning cash from their accounts.
The case of Billie Conley Jr., the IT contractor recently sentenced in federal court to nine months in prison for wire fraud, offers a sobering look at the digital vulnerabilities facing independent funeral homes. Court documents and federal prosecutors revealed that Conley used his Stratford- and Shelton-based firm, Ridgefield Tech, LLC, to exploit a local funeral home after being hired to install a new computer network and video surveillance system.
What appeared to be a standard vendor relationship quickly soured into extortion. According to the U.S. Attorney’s Office for the District of Connecticut, Conley secretly installed unauthorized remote-access software during the initial setup. Shortly after, the funeral home began experiencing recurring network outages and service failures. Every time the system crashed, the business owner was forced to call Conley back and pay out-of-pocket for service visits.
Red Flags, Sabotage, and $55,000 in Damages
This was the first of the red flags, especially after Conley attempted to lock the business into a recurring monthly IT support contract. According to reports, when the funeral home owner declined to pay what in retrospect looks like protection money, things got nasty. Between January and September 2024, federal investigators found that Conley remotely disabled the company’s computer network on 21 separate days, grinding daily operations, client coordination, and administrative scheduling to a halt.
The disruptions were severe enough to halt business entirely on multiple occasions. Desperate for a solution, the funeral home eventually brought in a second IT firm. Only then was the sabotage uncovered; the incoming technicians discovered that Conley had embedded deep, unauthorized access points into the infrastructure, making it impossible to regain control without starting from scratch. The funeral home was ultimately forced to spend roughly $46,000 on new hardware and emergency labor to rebuild its systems.
Ouch.
Beyond the digital sabotage, investigators discovered that Conley had illegally dipped into the funeral home’s bank accounts, skimming a little more than $9,000 between June and August 2024 to settle debts with third-party vendors and pay his personal cell phone bills.
Safeguarding Your Firm: Vetting and Internal Controls
For a funeral home handling sensitive client data, coordinating tight timelines, and maintaining continuous communication are critical. This case underscores a vital operational warning: trust but verify. Security experts say that independent establishments should regularly audit administrative access, restrict third-party vendors to monitored, least-privilege permissions, and maintain independent oversight of financial transactions to ensure that the people hired to secure a business are not the ones compromising it.
Evaluating and vetting an IT service provider is one of the most critical risk-management decisions a small business owner can make. Incidents like the federal case involving Ridgefield Tech highlight how vulnerability often stems from placing blind trust in a single vendor without structural safeguards or independent oversight.
Vetting an IT company before engaging them is critical. Beyond the basics, references in and around the community, business owners should see how long the company has been active, verify its physical addresses, and check for professional certifications. For providers handling sensitive administrative networks, video surveillance, and financial systems, business owners should also ask for formal proof of business insurance, bonding, and clear corporate accountability.
That’s the easy part. Once you’ve hired someone, it still makes sense to install strict internal controls. Ensure the IT provider does not have unrestricted, master administrator access to everything by default. Critical accounts like payroll, vital statistics portals, etc. should remain under the direct property control, with IT granted access only on an as-needed, logged basis.
Make sure as part of your deal that any software used for troubleshooting is explicitly disclosed, documented, and approved. If an IT vendor installs hidden background utilities or unapproved remote-desktop tools that cannot be easily monitored or disabled, that’s a problem for sure. Legitimate IT partners provide detailed ticket logs, explain what caused a failure, and offer permanent fixes rather than temporary band-aids.
Finally, and this was the action that caught Conley before he emptied out the business’ bank accounts, consider having a secondary, objective IT firm conduct a one-time security and network audit every year or two. An outside set of eyes can quickly spot unauthorized backdoors, hidden remote-access scripts, or lingering vulnerabilities left behind by current or past vendors.
