Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
City manager: scanned documents likely accessed in cyber incident; letters to affected residents forthcoming
Summary
City Manager Joseph J. Dennon told council investigators are nearly finished reviewing a recent cyber incident; databases appear intact but scanned PDFs that may contain Social Security numbers were likely accessed. Draft notification letters and a FAQ will be mailed to potentially impacted residents.
City Manager Joseph J. Dennon told Washington Court House City Council on Monday that investigators are nearing completion of a review into a recent cyber incident and that most core databases appear intact, but some scanned documents may have been accessed.
“That the databases appear to still be fine,” Dennon said. “The issues are when somebody scanned in, like, a PDF … they continue to go through that data.” He said staff have prepared draft notification letters and a frequently asked questions document and will proceed “forthwith” to send notices to people who may be affected.
Council members pressed Dennon on the scope and timing of the incident. A councilor asked whether Social Security numbers or other sensitive information were involved; Dennon said scanned PDFs can contain Social Security numbers and that the full extent is still being determined. “They appear to be, nearing the end of that process,” he said of the review team, noting the city will err on the side of notifying more people rather than fewer.
Some councilors questioned whether the city’s insurer or vendor delayed alerting officials. Dennon said the insurer identified an issue and continued researching the extent of the exposure; he added the city needed to discern which records were affected before mailing notices. “They would not have been prepared to conclude who we need to send a notice to, but they knew that they had an issue to continue to research,” Dennon said.
Councilors also discussed staff evaluations and response roles. Alan Johnson, identified in the meeting as the city IT contact, was noted by several members for long hours and a high performance score this year; councilors said they would review evaluation details but stopped short of assigning blame for the incident.
The city manager said the review to identify affected records is almost done and that notification letters will be mailed; no timeline for completion beyond that was given at the meeting. The council did not vote on any policy or action tied directly to the incident during the session.
Next steps: the city will complete the data-review process, finalize and mail the notification letters and publish follow-up information as the investigation proceeds.
