Cyberattack on Washington County government was first detected last week
County, courthouse offices remain offline while Homeland Security investigates
Observer-Reporter file photo
The cyberattack that has crippled Washington County’s government and courthouse was first detected late last week as employees tried to prevent it from spreading before it spiraled out of control Wednesday and forced the county to shut down its computer network.
County officials were first alerted to possible malware within the government server Thursday night into Friday morning last week, and information technology workers tried to prevent it from spreading elsewhere in the network, according to county Commissioner Larry Maggi.
“Things were happening that shouldn’t and they were attempting to find out what it was and doing what they needed to do,” Maggi said Thursday. “They noticed some suspicious activity and were doing what they needed to do until it progressed to where we’re at now.”
The issues continued over the weekend into Monday and Tuesday when it “became an issue” with growing concerns about whether the cyberattack could be contained.
The U.S. Department of Homeland Security also noticed unusual activity and directed the county to shut down its network early Wednesday morning while federal agents and third-party IT consultants investigated and determined how best to respond.
It has not been made public how the malware was introduced into the county’s server or how many computers have been affected by the breach. It’s also not known what was accessed or whether any data has been compromised or encrypted through the cyberattack.
The incident has left county government and courthouse employees without the ability to use their computers, although some tasks and duties were continuing as usual in a rudimentary fashion without technology. There is no timeline on when the computer network will be restored or when the county will be functioning normally.
“The safety and security of our residents and our employees remains our top priority. We are working around the clock through this cyber incident and ask for your patience as we implement continuity measures,” county spokesman Patrick Geho said in a statement released Wednesday night. “We are grateful to have some of the industry’s top experts helping guide our response. Together, we will fully recover from this event and move forward with a stronger and smarter computer network.”
He did not immediately respond to an emailed question about why the county did not act sooner to shut down the server upon learning of the breach late last week in order to limit the damage to the network.
A similar cyberattack happened in Bucks County over the weekend, although it’s not known if it’s related to the incident in Washington County. In Bucks, hackers disrupted portions of that county’s 911 dispatch system, according to a CBS News report posted online Tuesday. Washington County’s Department of Public Safety and its 911 dispatch center have not been affected by the breach and are operating normally, county officials said Wednesday.
Maggi said he is not overly concerned about the delayed decision to shut down the server, and planned to wait until more information is released on the incident to determine whether changes will need to be made to the network.
“This, from what I’m hearing, is a pretty serious interruption from an outside entity, and I want to make sure we’re doing everything we can,” Maggi said. “Technology is constantly changing. … I want to make sure we’re at the cutting edge of our IT system and we’ll make sure we look into that to make sure it’s done.”
An email sent Thursday morning to the U.S. Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency seeking comment on the situation was not returned.