Huntsville’s System Recovery after Cybersecurity Incident in Final Stages, Investigation Still Ongoing
The recovery of the Town of Huntsville’s systems after the recent cybersecurity incident is in the final stages. Thanks to the hard work of Town Staff, there are now minimal impacts to municipal services. The final phase following the cyber incident is a detailed investigation into impacted data, which is currently ongoing and is a time-consuming process.
“I understand that the community is anxious for the details, however it is our responsibility to ensure that we act in the municipality’s best interest throughout this incident and the resulting investigation,” says Denise Corry, CAO at the Town of Huntsville. “We are still in the midst of the investigation and are limited in the level of detail we can provide at this time. We are committed to disclosing as much information as possible once the investigation is complete.”
What does “system recovery” from this cybersecurity incident look like?
The ransomware attack on the Town of Huntsville that was discovered on March 10, 2024, had significant effects on the Town’s computer systems, software, and files, which led to them being inaccessible for a period of time. The process to bring all impacted functions to full service has been onerous and required many steps and checks to ensure that each system was restored in a secure manner and was working as expected before being made available for use. Each application needed to be brought back online, any required files recovered, and then final testing of application functions. In many cases, such as the Town’s GIS Mapping System, there are many interconnecting components that support Parks, Public Works, Building, and Planning, as well as external community members.
As per the recent Municipal Service Update, thanks to the hard work and dedication of Town employees, all but one internal system, and all external facing systems are now in operation. The outstanding internal system is the historical archival system, impacting access to various records such as building plans, by-laws, and other official documents. We continue to work on these delays and encourage residents to call Customer Service at 705-789-1751 if there are concerns about your service request.
What is involved in the detailed investigation into any data impacted by the cybersecurity incident?
The important final phase in the investigation of the cyber incident is the detailed investigation into the nature and extent of impacted data, which is currently ongoing. This process is a very time-consuming undertaking and, while we do not yet have a timeline for completion, it will likely be a matter of months.
The Town is continuing to work with third-party experts to complete a comprehensive review as quickly as possible. Any individuals who may be found to have been impacted will be notified directly. We thank everyone for their patience and understanding as this detailed investigation is ongoing.
When will more information become available regarding the details of the cybersecurity incident?
The Town is sharing as much information as possible with the public regarding this cybersecurity incident. Due to the legal and security implications of the cyber incident and time-consuming nature of the resulting investigation, the municipality is limited in the details we are able to share.
Once the full investigation into the cybersecurity incident has been completed, the Town will provide more detailed information to the community.