Public Money Vanished From South Padre Island's EDC. Three Weeks Later, Officials Still Won't Say How Much.
Someone hacked South Padre Island's economic development agency and sent public money to a fraudulent account. Federal agents are on the case.
Nearly three weeks after the city disclosed it, the people who paid that money still have not been told how much is gone.
They have not been told when it happened, whether any of it has been recovered, or which projects might suffer. The full public explanation so far is one prepared statement read aloud at a city meeting.
That is not good enough.
WHAT WE KNOW
On Wednesday, Oct. 7, South Padre Island Mayor Patrick McNulty read a prepared statement at the end of a city council meeting, after public comment. He said the South Padre Island Economic Development Corporation had been the victim of a cyberattack that resulted in an unauthorized transfer of funds to a fraudulent account.
"Federal agents are working closely with the EDC to conduct a thorough investigation into the attack and track the fraudulent transfer," McNulty said.
A Department of Homeland Security spokesperson later confirmed to KRGV that Homeland Security Investigations is working with the city on what the agency called an alleged financial scam. The spokesperson said no further information was available.
The city called it an isolated incident. It said the EDC runs on an email system separate from the city's, that the city's own financial safeguards and core operations were unaffected, and that the city has reviewed its administrative security protocols.
When reporters followed up, they got almost nothing. The EDC sent KRGV the same statement the mayor read. EDC board member Gayle Hood told KRGV she had no comment. The Port Isabel-South Padre Press asked city officials for the amount, the date the incident was discovered, any recovery of funds, and what is being done to prevent a repeat. As of the Press's Oct. 15 story, no one had answered.
WHOSE MONEY IS THIS?
Yours. The SPI EDC is funded by a half-cent local sales tax. Every visitor who buys a meal, a T-shirt or a tank of gas on the Island helps pay for it.
McNulty said that sales tax revenue is maintained within the city's coffers. That makes the silence harder to defend, not easier. This is public money held by a public body.
For a sense of scale, the city's own financial reports show the EDC's share of local sales tax running roughly $72,000 to $117,000 a month during the fiscal year that just ended. Depending on the size of the theft, one fraudulent wire could wipe out months of public investment. That is exactly why the number matters.
WHAT THEY STILL HAVEN'T TOLD US
How much money was transferred
When the transfer happened, and when it was discovered
Whether any of it has been frozen or recovered
Whether insurance covers the loss
Whether any EDC projects or commitments are affected
What specific safeguards failed, and what has changed since
None of these answers would expose an investigative technique or tip off a suspect. A dollar figure is not a trade secret. Cities across the country hit by wire fraud have disclosed what they lost while federal investigations continued.
ANALYSIS: WHAT THIS LOOKS LIKE
The city's statement went out of its way to point out that the EDC uses a separate email system. That detail fits the pattern of business email compromise. In those scams, criminals hijack or impersonate an email account and trick staff into wiring money to an account the criminals control, often by posing as a vendor or an official asking for an urgent payment change.
The FBI ranks business email compromise among the costliest forms of cybercrime in the country, with reported losses in the billions of dollars every year. Small public bodies with few staff and few payment checks are frequent targets.
To be clear, officials have not confirmed how the attack worked. This is analysis based on what they have chosen to say.
WHY THE SILENCE IS THE STORY
The EDC is the victim of a crime here. Nobody is suggesting otherwise. But being a victim does not cancel the duty to tell taxpayers what happened to their money.
Under the Texas Public Information Act, government records are presumed public. A governmental body that wants to withhold information has to ask the Texas Attorney General for permission and cite a specific legal exception. Ongoing investigations can justify withholding some details. They do not automatically turn the amount of lost public money into a state secret.
Three weeks of "no comment" makes residents wonder how big the hole is. If the number were small, officials would have every reason to say so. Instead, the public is left to guess.
Island residents and business owners can ask the same questions. The EDC board meets in public, and public comment is open at city council meetings. The next time the EDC asks for trust and tax dollars, the first answer it owes the public is a simple one: How much?
SOURCES
KRGV, "South Padre Island says EDC cyberattack sent money to fake account, federal investigation underway," October 2026
KRGV, "Homeland Security Investigations looking into cyberattack at South Padre Island EDC," October 2026
Port Isabel-South Padre Press, "Federal Investigation Underway After SPI EDC Cyberattack," Oct. 15, 2026
ValleyCentral, "SPI Economic Development Corporation admit to cyberattack," October 2026
City of South Padre Island, EDC financial memo and sales tax report
Comments