On Nov. 22, the town staff lost internet access and electronic files were encrypted after a malicious email was opened, Town Manager Kristin Aleshire told The Frederick News-Post.
CBM Systems Inc., which contracts with the town for IT services, worked with the staff to recover most of the files, according to Myersville Planning and Zoning Administrator Brandon Boldyga’s Dec. 2 memo to the mayor and council.
Small and medium-sized businesses, and clients like Myersville, aren't typical targets of this type of malware, Kody Moser, a network technician at CBM, said in an interview.
It's more likely that the town staff was caught up in a mass phishing attempt, in which he said. Moser was one of the CBM employees who worked with the town during the November incident.
Phishing refers to the practice of sending fraudulent messages, such as email, to trick recipients into sharing personal information.
Residents’ data wasn't affected and information was not taken, Aleshire said. Files were restored via a backup copy.
At the time of the incident, which Boldyga described as a “catastrophic server failure,” the town’s “lack of robust anti-virus and anti-cyber-attack software” were an issue, he said.
In an interview and emails with the News-Post, Moser, Boldyga and Aleshire also described the incident as a ransomware attack. Moser said the attack was stopped before any outside parties could request money.
“The Town was fortunate that the network was not targeted by a more severe cyberattack. The launch of this attack made it very apparent that the Town was caught completely off guard,” Boldyga's Dec. 2 memo says.
The source of the malware has not been identified, Aleshire said. The town has since installed additional security software on its computers and notified the federal Cybersecurity and Infrastructure Security Agency of the incident.
Boosting the budget
In a proposal for the fiscal year 2025 operating budget, the town staff allocated $45,000 to information technology services, up from $9,000 in fiscal year 2024.
The proposed amount “is anticipated to address a number of IT related functions which have grown over time beyond the capacity for current town staff to manage,” Aleshire wrote in an email.
“The reason for the proposed increase in our FY25 budget has nothing to do with the occurrence of the server going down in November,” he said in an interview with the News-Post.
In his memo, Boldyga said he assumed the role of Myersville’s IT staff, but it was not a primary part of his job. With IT needs piling up — ranging from troubleshooting printers to maintaining security cameras — he asked the council to hire additional staff or contractors to handle those tasks.
“We have attempted to manage, in-house, to the best of our ability, with staff that we have and contracts with service providers,” Aleshire told the News-Post. Additional providers are needed because the town doesn’t have a dedicated information technology staff, he said.
The mayor and council worked with Myersville’s budget committee to arrive at the $45,000 estimate, though it will not be final until the budget is approved. The town may opt to contract with multiple entities, and CBM will be eligible to bid on the expanded services, he told the News-Post.
“We may end up hiring a part-time person to do some of that. This is a new venture for us, so I can’t really say at the moment,” he said.
The mayor and council are interested in requesting bids from information technology service providers, Aleshire said at the council's meeting on Tuesday.
The pay for a social media manager may also be included in that part of the budget, Myersville Mayor Mark Hinkle said at the meeting.
The potential investment is part of a trend toward bringing town hall up-to-date with technology. When he started working for the town in 2008 as its first manager, Aleshire told the News-Post, “We had one computer and we took turns using it.”
The IT expense is the largest increase in the fiscal year 2025 budget compared to fiscal year 2024, Hinkle told the News-Post.
“As we become more tech dependent, I feel like we’re going to need to adapt,” he said Tuesday.
© 2024 The Frederick News-Post (Frederick, Md.). Distributed by Tribune Content Agency, LLC.
