MSP Denies Destroying Office 365 Data in Nonpayment Flap

A Georgia managed services provider (MSP) repeatedly harassed a client who refused to extend an expiring contract, then shut off access to the organization’s website and Office 365 account, before permanently deleting large portions of the customer’s data, authorities allege.

James Kubicek insists he was within his rights to shut off access to his client’s Office 365 account after the customer – the Forsyth (Ga.) County Chamber of Commerce – refused to fulfill the final two years of a three-year IT services contract.

Chamber officials say the contract with Kubicek Information Technologies (KIT) was for one year, and that they exercised their right to go with a different MSP once the term expired.

Whether Kubicek is an aggressive entrepreneur or a criminal hothead guilty of multiple felonies will be decided in the courts, where a Forsyth County grand jury is expected to consider an indictment sometime this spring.

Kubicek – who goes by “Jim” – is currently free on $13,555 bond and running his business as the legal process takes its course.

His attorney has advised him against discussing details of the case but he offered a few broader statements.

“We are innocent of all allegations that are out there,” Kubicek told MSPmentor this week. “There is no truth to any of the allegations being made by the parties.”

He says he has every intention of collecting on roughly $78,000 he said he’s owed by the chamber.

“This is simply a civil dispute between the Forsyth County Chamber of Commerce and KIT,” he continued. “They didn’t pay for the service and access was shut down to the service that they didn’t pay for.”

Detective Frank Karic, a white-collar crime expert at the Forsyth County Sheriff’s Department, disputes Kubicek’s version of the case.

“Kubicek was extorting the Chamber of Commerce by holding their systems hostage and thereby their ability to conduct the most fundamental activities of their business operations,” the investigator said in his report.

Kubicek had been a steady member of the chamber by the time he agreed to take over their IT services, a little more than a year ago.

The chamber provided investigators with a contract that indicates the deal was for one year, through Dec. 1, 2016.

The arrangement involved no cash, only an exchange of in-kind services that would allow, among other things, KIT to post advertising at chamber events, Karic said.

In October of 2016, investigators say Kubicek emailed a renewal notice to the chamber.

“It said, ‘It’s that time of year to consider a renewal of our services agreement,’” the detective said.

That email included a cash price quote for renewal of the services contract, Karic said.

“(The chamber) decided that since Kubicek’s quote was substantially higher, they notified him that ‘hey, we shopped the rate,’” the investigator said of his interview with chamber officials.

“Your quote was substantially higher, so we we’re going with someone else,” he says they told the MSP.

Kubicek responded by sending the chamber a contract offer that underbid the other competitors, the investigator said.

“He did lower the quote below everyone else,” Karic said. “There was such a large difference between the value of the first quote and the second quote, it made them uncomfortable.”

Discrepancies

The chamber instead decided to go with Dime IT, another outfit out of Cumming, Ga., the government seat of Forsyth County.

On Nov. 25, Dime IT sent an email to Kubicek, seeking “credentials and information for ‘servers, domains, laptops, workstations, routers, switches, access points, etc.,’” Karic said.

What followed, authorities said, was a bizarre series of communications during which Kubicek allegedly seemed to not acknowledge that the chamber was moving on from his IT services contract.

Chamber officials told investigators they continued to behave cordially toward Kubicek, making every effort to keep him in the chamber fold.

“He continued to plead with them and tried to persuade them to keep his services,” Karic explained.

On Nov. 28, Kubicek’s tactics changed markedly, authorities say.

“After he had failed to sway them, on the 28^th, he sends an email response to Dime IT and the chamber saying ‘I mistakenly entered it into my system as a one-year contract, but it was actually three years,’” Karic said.

The rate of increase was 3 percent for each of the subsequent years, the detective said.

“This was the first time (the chamber) had ever seen or heard about this three-year contract,” he said, adding that the multi-year contract bore a stamp that read “Version 1.”

The copy of the contract presented by Kubicek was marked “Version 2,” Karic said.

“When I analyzed both contracts, I found several other discrepancies in the actual content of both contracts that made it very clear to me that this was altered after the fact – that this was not a legitimate contract,” the investigator alleged.

It was around this time, Det. Karic said, that Kubicek’s wife sent an email – which she later said was at the direction of her husband – requesting that chamber officials remit a completed authorization for a bank draft to pay for the continuing service.

Meanwhile, the chamber and its new IT services contractor made repeated requests through email and via Kubicek’s online support ticketing system for the credentials that would allow them to switch over the service.

Karic cited a Dec. 1 reply from KIT to the chamber. 

“He just responded that they were working on it and that he would comply when he could,” the investigator said. “He would get back to them when it was available.”

Later that day, Kubicek allegedly sent another email with the same authorization form.

“It said, ‘please fill this out so you don’t suffer any interruptions in service,’” Karic said.

‘Interruptions unless they paid up’

A 13-year veteran investigator, Karic said he rarely speculates about the circumstances of the cases he handles because he rarely needs to.

“Most of my cases are white collar,” he said. “Ultimately, my decisions are made on documents and hard evidence.”

That hard evidence in this case points to the suspicion that Kubicek’s conduct was criminal, investigators allege.

“He hadn’t provided any of the credentials and he was beginning to make threats of service interruptions,” Karic said. “He was threatening service interruptions unless they paid up.”

The chamber sent a final email on Dec. 1^st asking why it was taking so long to gain access to their credentials and asserting that the requested information should be easily accessible.

Two days later, on Dec. 3, the chamber’s executive vice president, Jimmy Lane, received a response from Kubicek: “Any news on that payment form?”

When the chamber didn’t respond, Kubicek made good on his threat, authorities said.

“Kubicek eliminated his hostage,” the detective wrote in his report.

KIT restricted the chamber’s access to its IT assets.

“(The chamber) tried to contact Microsoft and learned that not only had he canceled the account, he had the data deleted,” Karic said. “First he canceled it, and then he requested that they delete anything that had been saved on the account.”

The chamber was able to recover data that it had on some legacy hardware, investigators determined. But data generated from its Office 365 accounts was intentionally deleted and is unrecoverable, Karic said.

“Let’s just say that, for purposes of discussion, there was a contract dispute,” the detective said. “His service was only to manage their property.”

“So he can’t withhold their property,” Karic continued. “He can withhold the service of it.”

Kubicek said that any allegations that client data was deleted are incorrect.

“That’s false,” the MSP owner said. “That’s all I have to say about that – that’s false.”

Nonetheless, on Feb. 2, Karic executed the arrest warrants he had obtained for Kubicek.

The detective learned the MSP owner was at a nearby job fair.

He showed up and said he subtly pulled Kubicek aside.

“As professionally and quietly as I could, I asked him to step out of the room,” Karic said.  “I arrested him and took him out.”

Asked if Kubicek was cooperative, the detective said: “He was cooperative enough to not get another charge.”

“He was angry; he was argumentative,” Karic said. “He was compliant enough.”

A legal showdown over how far an MSP can go when a client fails to pay for service is looming in the courts at Forsyth County.

“Right now it’s in the hands of the District Attorney,” Karic said. “The next step will be a formal indictment.”

Send tips and news to [email protected].