The Delaware County IT committee told the council on Dec. 16 that a credential-harvesting email was sent from an internal address and several staff clicked the malicious link, potentially exposing the county network.

The committee asked that all users, department heads and staff change passwords immediately and urged more cybersecurity training. "They ask that you change your password to something completely different, not just, you know, changing the last numeric number," the IT representative said, stressing that anything suspicious with links should not be clicked and should be reported to the IT team.

The report also said longtime contractor Jim Fluke will not renew his contract at year-end. Commissioners and IT staff are working to transition services, either by hiring county employees or contracting roles; Commissioner Brandon and HR were cited as coordinating those steps. The committee said the discussion about moving county email from Microsoft to Google is paused until after the first of the year while staff stabilizes operations.

Council members asked clarifying questions about password-change instructions and the scope of required changes; IT will provide additional updates to council next month.