County Confirms It Was Hit by a Cyber Attack

A county official confirmed last week that the computer network issues the County experienced back in March were indeed the result of a cyber attack.

Fayette County Emergency Management Coordinator Angela Hahn told the Record last week that investigators believe someone tried to stage a ransom attack on the County’s computer systems. But she said the County did not pay a ransom.

“None of our County data or employee data has been compromised,” Hahn said.

All systems have been restored, she added.

“On March 2, we realized that we had an incident that disrupted our network,” said Hahn.

Hahn said County IT Director Kevin Wunderlich took immediate action to protect the County’s computer systems. She said his actions prevented the County from suffering even worse consequences.

The County reported the incident to state officials. An incident management team from the Texas Association of Counties (TAC) assisted Wunderlich in getting the County systems back online.

The attack shut down the County’s computer aided dispatch system used by law enforcement, EMS and fire departments when responding to calls. The attack did not affect radio communications, Hahn said, so human dispatchers were still able to communicate with first responders in the field.

Perhaps the most frustrating aspect of the cyber attack for most County employees was the loss of email communications. The attack took County email accounts offline for a couple of weeks.

“We had to go back to pen and paper for a little bit,” she said.

Hahn said the County never received any communication demanding a ransom payment.

“We’re not even sure the threat actors knew they were in our system, that we weren’t actually their target,” Hahn said.

Hahn said investigators believe the threat actors were targeting a technology vendor used by another company the County contracts with for IT services.

“From what the team was able to determine, one of our (technology) vendors was using another vendor, so we were the third party in line,” Hahn said.

Hahn said the investigators didn’t share much information, even with County officials, in an effort to keep secret any vulnerabilities.

“Part of the reason they keep it as quiet as they do is because people watch the local media to see what’s out there,” she said. “That’s why we didn’t share much information, because we don’t want to give anything away, not to the public, but to the threat actors. But I think its important for County residents to know that none of our data was compromised and we did not pay a ransom.”

“We did incur some costs,” Hahn added. “I don’t know what those totals are. We have cyber security insurance like most counties do. So most likely those costs will be reimbursed. But I don’t know the total because we’re still gathering that information.”