|
Dear Neighbors,
We are continuing to make steady and effective progress in restoring the systems that were impacted by the cyber-attack we discovered on July 18. To date, all of the city’s most critical IT systems have been restored, and we will continue to work through our entire IT environment until we achieve full restoration across all our systems. Specifically, 72% of the city’s 441 technology systems are fully restored, and another 5% are partially restored. Our goal is to have all systems up and running at peak efficiency by the end of October.
We are also gaining a clearer picture of the financial impact of the cyber-attack that was committed against us by Rhysida, a sophisticated ransomware group that operates overseas. When the attack was identified in July, I issued an emergency order authorizing the Department of Technology to invest up to $4 million to protect and restore the city’s technology systems, and to conduct a thorough investigation to understand how the cyberattack occurred and the extent of the systems and data that were potentially impacted.
Since then, we’ve incurred additional expenses as a result of the ongoing investigation and restoration efforts. This includes the city offering free Experian identity theft protection services and dark web monitoring to all who were impacted. These services are being provided as a precautionary measure because Rhysida posted sensitive data to the dark web.
On Monday, the Department of Technology will present Columbus City Council with legislation to authorize $7 million – including $3 million in new funding – to cover costs through the remainder of the year. Future legislation will also be presented for anticipated legal expenses.
Here’s how our budget currently breaks down:
- Up to $2,401,052 for system forensics, systems remediation, data mining, data forensics and cyberthreat monitoring. These services are helping to limit the extent of the cyber-attack, understand what occurred, and determine what information was posted to the dark web by Rhysida.
- Up to $1,644,348 for Experian identity theft protection services, including credit and dark web monitoring for the public.
- Up to $1,952,100 for legal counsel related to the incident response.
- Up to $1,000,000 for systems, endpoint and cyber-threat monitoring for long-term use by the city.
- Up to $300,000 for legal counsel related to litigation.
- Up to $2,500 for expenses such as hard drives and tools.
This budget does not include the long-term investments the City of Columbus will need to make to further protect its technology systems and data from the growing threat of cybercrime. The safety of this community is my top priority – and we will purposefully and intentionally pursue those investments as they are needed.
In the meantime, I strongly encourage you to enroll in two years of free Experian credit protection, dark web monitoring and up to $1 million in identity theft insurance. This service is available to anyone who may have shared their personal information with the City of Columbus or municipal court – including both residents and non-residents. Visit www.columbus.gov/cyber to enroll.
Cyber-attacks occur every single day – in cities and organizations large and small all over the world – but we are committed to going the extra mile in Columbus to protect our residents, repair the damage that has been done and prevent future attacks. This work is complex and ever-evolving, and it requires our full and deliberate attention, but I am confident we are making excellent progress in restoring our technical infrastructure and building back stronger than ever before.
Sincerely,
|
