More than 20% of Columbus’ systems are still down nearly two months after this summer’s cyber attack against the city, Sam Orth, Mayor Andrew Ginther’s technology chief, revealed in his second weekly update to City Council on the incident.
The attack compromised the personal information of hundreds of thousands of city employees, residents and others.
“We have a lot of work ahead as a city on multiple fronts,” Orth told Council Monday, adding that data breaches “are always learnable and teachable moments.”
Orth confirmed under questioning that Ginther has used his emergency powers as mayor to approve $4 million in technology spending related to recovering from the breach since July, $3 million of which was spent on operations and $1 million on capital purchases. Orth said the administration would ultimately bring the ordinance to City Council for its vote on approval, but it was unclear what would happen if councilmembers voted it down, since it is already being spent.
Orth said one of the first moves the city made — on July 19, the day after the city says the data breach had been detected — was to hire a law firm, Dinsmore, with offices nationwide and in Columbus, which provides data breach and incident response legal advice. The city has since hired DigitalMint and Haystack, both firms that provide cybersecurity consulting, Orth said.
To date, almost two months into the cyberattack, 21% of the city’s various computer systems are still down, and another 8% are only partially functional, Orth said. Those numbers are marginally better than a week ago, yet Orth said he’s still not ruling out a complete recovery by the end of September. The industry standard for recovery time is about 150 days, or about three more months, he said.
Columbus cyber attack: Columbus City Council briefed on data breach: Here’s what we learned
Orth said the city is still trying to determine how the attackers gained access, which systems were compromised, “and what they touched.”
RSM, the cybersecurity firm that the city already had under contract when the attack occurred, had personnel on site in Columbus the day it happened, Orth said.
The city hopes to have completed a written report on the incident by the end of October, and it will be publicly available, Orth said, noting that stolen data included crime information “from several systems,” personal information on employees and visitors to city buildings, and even “locations of Fire Department runs.”
“The sheer volume of records makes it impractical to notify everyone individually,” Orth said.
Thus far, about 14,000 residents, employees and others have signed up for free credit monitoring and identity theft insurance. Anyone who believes they may be affected is able to register through Nov. 29, it takes roughly 10 minutes to enroll.
After appearing before Council, Orth quickly left the chambers — this week through the main doors, and not through a balcony emergency exit door, as he did last week — and he again didn’t make himself available for questions from the news media.
@ReporterBush
This article originally appeared on The Columbus Dispatch: Ransomware attack leaves Columbus computer systems down 2 months in
EMEA Tribune is not involved in this news article, it is taken from our partners and or from the News Agencies. Copyright and Credit go to the News Agencies, email news@emeatribune.com Follow our WhatsApp verified Channel
