Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity Incident Response topic
No spam. Unsubscribe anytime.
Wayne County approves $250,000 cap for outside counsel to respond to October 2024 cyber incident
Summary
Commissioners approved Amendment 1 to a two‑year legal services agreement with Clark Hill PLC to fund data‑forensic and legal work tied to an October 2024 cyber incident; county officials said Clark Hill estimated total costs could approach $1 million but the county's out‑of‑pocket exposure is limited by insurance deductible.
Wayne County commissioners approved Amendment 1 to a two‑year legal services agreement with Clark Hill PLC, authorizing up to $250,000 in county spending to secure legal and privacy counsel support related to a cyber incident that occurred in October 2024.
County officials said the firm will assist with data mining, analysis and required notifications to individuals or agencies should the forensic review show that personal information was exfiltrated. The work is intended to identify what data, if any, left county systems and what legal steps are required.
Deputy Corporation Counsel said the amendment covers legal advice tied to notifications and other legal measures while the county continues its review. "There are legal requisite notifications that may need to go up," the deputy counsel said.
Ryan Hayes, division director for computing infrastructure for Wayne County, described Clark Hill as a privacy and legal resource supporting the county’s forensic review. "They're privacy councils. They're assisting us with data mining and, data analysis. So looking for how it was breached, that kind of thing? They're examining the data that was exfiltrated," Hayes said.
Commissioners discussed cost uncertainties. Officials told the commission they received an estimate from Clark Hill and related vendors that the total response work could cost "upwards of close to a million dollars." County staff said the contract amendment limits county spending to $250,000 because that is the county's insurance deductible; amounts above that would be submitted to the county's insurer for reimbursement.
The commission approved the amendment on a motion by Commissioner Wilson, seconded by Commissioner Kinesick. The clerk announced the motion was carried; no roll‑call tally was read into the record.
Next steps described by staff include ongoing forensic analysis and, if the review shows legal notification obligations, issuance of the required notifications and any additional legal measures identified by counsel. The county said there is no active litigation at this time.
