Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
Cass County IT reports coordinated business‑email compromise campaign; says incident contained
Summary
The county’s IT director described a statewide business‑email compromise campaign discovered May 12, high initial click rates but no confirmed credential theft in county accounts, and rapid containment actions; the report also covered Windows 11 rollout, printer isolation and multi‑year IT cost savings.
Cass County’s Information Technology director reported a coordinated statewide business‑email compromise (BEC) campaign that county IT began detecting on May 12 and said county staff contained before the campaign led to credential compromise in local accounts.
The IT director said the initial wave included hundreds of malicious emails (the first wave was described at roughly 450 messages), with a 15–20% click rate on the initial messages; county staff reported that clicks did not result in credential submission by county users. The director described the attackers’ use of “real‑time reverse proxies” that mimic OneDrive and other services to harvest credentials quickly when users entered them, but added that county procedures and rapid containment limited damage. IT staff said they detected indicators and had blocking rules in place; they also notified regional partners such as West Fargo and assisted in blocking the campaign there.
IT staff described immediate remediation steps: password resets, enforcement and verification of multi‑factor authentication on affected accounts, inbox clean‑ups and targeted user follow‑up. The director said detection and response began within two hours of identifying the campaign and that in at least one instance county staff began containment before the state IT group notified the county.
The IT report also covered routine technology projects: a printer‑isolation project to move networked printers to a more secure segment; deployment of Windows 11 and an endpoint refresh (about 75% complete); a county backup infrastructure upgrade claiming speed improvements; and completion of a sheriff command‑vehicle installation. The director said multi‑year procurement choices and vendor negotiations produced about $788,000 in estimated cost savings over five years and named Nortek Solutions as a vendor used for server quotes.
Commissioners and staff asked operational questions about printing and device support; the director said training and follow‑up would continue.
