[BreachExchange] Allentown computer virus fix to cost extra $220, 000

[Destry Winant]

http://www.mcall.com/news/local/allentown/mc-nws-allentown-cyber-attack-cost-20180731-story.html

Costs continue to rise for Allentown as it grapples with a cyberattack
that crippled some of the city’s most vital systems earlier this year.

An extra $220,000 will be needed to pay for virus remediation,
according to an ordinance to be considered by Allentown City Council
on Wednesday. That comes on top of the nearly $1 million that the city
has already spent to rebuild systems following the attack.

According to city documents, the additional money is needed to change
Allentown’s licensing model with Microsoft to “ensure a secure
environment for the future.” Allentown is in the final year of its
licensing agreement with Microsoft.

Allentown was struck by a malware virus known as Emotet in
mid-February, an attack that threatened all city systems that run on
Microsoft, including the city’s 185-camera surveillance network.

Representatives from Microsoft were immediately hired for an initial
$185,000 emergency response fee to contain the virus, which was
stealing credential information from city employees such as passwords.
In April, a $961,140 bill was submitted to council, which included the
initial $185,000 fee.

City officials said at the time there was no evidence to suggest any
personal information of residents had been compromised.

Paying for the fix required Allentown to tap its cash reserves, which
had already been reduced to balance the city’s 2017 and 2018 budgets.
Money was also drawn from other areas of the city budget such as the
solid waste fund and the streets department, requiring the city to put
off improvements to the recycling drop-off center and to postpone
hiring employees.

City administrators have recommended drawing the extra $220,000 from a
line-item dedicated to contracts in the city IT budget.

Allentown officials previously discussed the cyberattack publicly over
vehement objections from the city’s IT director. This time, City
Council met in a private executive session to discuss the issue,
according to its agenda for Wednesday. Mayor Ray O’Connell and
Managing Director Joe McMahon were present, as were members of the IT
staff and a consultant.

“Matters of cybersecurity are confidential under both the federal
Homeland Security Laws and the Pennsylvania state Confidential
Security Information Protection Law,” council’s agenda states. “This
subject matter is not subject to the open meeting requirements under
the Sunshine Law.”

O’Connell could not immediately be reached for comment Tuesday.

Allentown City Council will meet Wednesday at 7 p.m. in City Council
chambers, 435 Hamilton St.