Commissioners Fail to Approve Funding That May Have Prevented Successful Cyber Attack

There’s an interesting story in the free weekly publication, City Pulse out of Lansing, Michigan about the Ingham County computer systems. The events remind all of those in charge of networks and computer systems for any organization, of any type or of any size, that addressing known vulnerabilities is not something that should be put on the back burner. In this case, the county commissioners were warned over a year before the event that something like what did happen could occur and yet, they voted to table the budget for patching the systems, which turned out to be even more costly.

In 2014 at a meeting in Ingham County, commissioners were warned that vulnerabilities existed in the county’s computer systems and they needed to be addressed. In February of this year, a budget of $30,000 was requested by the Innovation and Technology Department to hire a firm to focus on the cybersecurity area and specifically patch those vulnerabilities. No one had been dedicated to cybersecurity at the county since the previous person had retired. Tasks were falling through the cracks.

The acting director of the department warned the commissioners of the urgency of updating the systems. Yet, they tabled the budget putting off till a new full-time director was hired and could evaluate it.

Unfortunately, that was too late. In early May on a Friday afternoon, malware made its way through the network affecting over 1,600 computers. The helpdesk staff worked through the weekend taking at least 15 minutes per machine to eliminate the malware. In one case, it took over 2.5 hours and the computer was still not fully functional. Monday morning rolled around and some departments remained closed so the IT department could continue their work to eliminate the threat.

It is not known how the malware made it into the network. However, often and even typically it is because someone inside fell prey to phishing.  An email arrives that is either unexpected or from an unknown sender that includes a link or attachment. The recipient inadvertently clicks on it and off goes the malware.

Had the computers been patched as the IT folks requested, perhaps even if the malware went wild through the system, it wouldn’t have gotten very far. So patching and updating systems is paramount for avoiding such issues.

There is not a lot known about the particular malware. The only disclosed element is that it was seeking banking information. Whether or not it was successful is not clear. The total price tag was not known at time of this writing, but Thomas Holt, a cybercrime expert and assistant professor at the University of Michigan estimated that it would be over $100,000 just for the repairs. That does not include labor time, lost productivity, closing of departments, etc. However, whatever the cost ends being, it will be certainly significantly more than the initial $30K that was requested.