Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Breach Recovery topic
No spam. Unsubscribe anytime.
Apex regains exfiltrated town data after court order; official says no evidence of identity theft
Summary
Apex officials say law enforcement traced stolen municipal data to a U.S.-based company, secured a temporary restraining order, and recovered roughly three terabytes of files; forensic review is ongoing and the town reports no evidence so far of identity theft or dark-web exposure.
An agency official told attendees that the town's data, which had been exfiltrated in a recent cyberattack, was traced by the FBI and other law enforcement to a U.S.-based company and recovered after the town won a temporary restraining order in court.
The official said the domestic hosting was an anomaly compared with typical foreign-server exfiltrations and allowed the town to pursue the files through the U.S. legal system. "The judge agreed with us, granted a restraining order," the official said, and "we then brought that data back." The official added that the returned package amounted to roughly three terabytes and was delivered in bulk: "kind of like 52 card pickup ... they threw 3 terabytes of data at us."
Why it matters: the recovered files may contain personal information tied to town residents and customers, and state reporting requirements apply if certain data elements were exposed. Town leaders said they are conducting a forensic review to determine precisely what was taken and who is affected, and that notifications to potentially impacted individuals are underway.
The official described the recovery process: after law enforcement identified the host, the town pursued access through the courts, regained custody of the files, and hired a third-party vendor to help sort and analyze the returned data. The official said the vendor's work is necessary because the returned package included files that were not the town's, which required additional time to separate town records from unrelated material.
On risk to residents, the official said vendors and town staff have monitored criminal markets and the dark web and so far have detected no evidence that the data has appeared there. "We don't believe identity theft occurred," the official said, and added that monitoring remains active.
The official credited coordinated efforts with the FBI, local law enforcement, and the town's legal team for enabling the recovery. He said the town also has reporting obligations tied to the incident and is working through those steps publicly.
Next steps include completing the forensic analysis, finishing notifications to affected parties, and continuing external monitoring for signs of misuse. The official said the town has also undertaken security reviews and testing to reduce the risk of recurrence.
