Everett City Hall will stay closed through Thursday, September 17. The city said so late Saturday night, on Facebook, in a post that describes “the ongoing cybersecurity incident” and asks for patience. By Thursday the building will have been shut to the public for eight business days, and the city will have gone eleven days since it found intruders on its network without saying what they did.
“We recognize this closure is an inconvenience for our residents,” the post reads. “While crews continue working as quickly and safely as possible to restore City operations, basic municipal services will be available at the Connolly Center (90 Chelsea St.) from 9 a.m. to 5 p.m. each day.” The City Council meets Monday as scheduled, and other boards and commissions keep their dates. Residents are told to call 311.
How the news came out
It is worth noticing how the extension was announced, because it says something about the state of the city’s systems. There is no new notice on the city website. Instead the September 8 post, the one that originally said City Hall would be closed Wednesday and Thursday, has been edited in place. Its headline now reads “Services Available at Connolly Center as City Hall Closes Through Sep 17.” The web address still contains the words “wednesday-thursday.” Anyone who read the original on Tuesday and did not go back would not know the date moved.
The city’s X account, which posted a Rosh Hashanah greeting Friday and a notice Saturday about a stadium information session, has not mentioned the closure since it began. Facebook got the Saturday night post. The website got a silent edit. That is the communications pattern of an organization working off whatever it has left.
What is still not said
Nothing in the Saturday post, or anywhere else, describes the attack. The city has not said whether it was ransomware, whether data on residents or employees was taken, whether a ransom was demanded, or which outside agencies are involved beyond the Everett Police and unnamed “cybersecurity professionals.” No criminal group has claimed Everett on the sites where they post their victims. The only official measure of severity is the calendar: a closure first announced for one day is now scheduled to run at least eight.
For comparison, Attleboro’s city phones and email went down on November 20 last year and the city was still rebuilding servers in December. Andover’s shared town and school network was out for four days in August. Everett is already past Andover and heading toward Attleboro.
What works and what does not
Police, fire, 911, public works, the schools and the libraries have run normally throughout, the schools because they sit on a separate network. Online bill payments go through outside vendors and still work. The Connolly Center desks cover the Treasurer and Collector, Assessor, City Clerk, Engineering, Auditing, Procurement, Inspectional Services, Housing Assistance and Parking. Parking for visitors is in the stadium lot on Spring Street.
What does not work is anything that needs the city’s own servers: records lookups, permits that run through the internal system, the email accounts of everyone who works in the building. If you have been waiting on a call back from a City Hall department since September 8, that is why.
Monday night
The City Council meets Monday, in person, on schedule. It will be the first public meeting of the council since the attack, and the first chance for anyone to ask the administration on the record what happened. The agenda was set before the extension was announced. Whether any councillor puts the question is up to the eleven of them. For a body that will eventually be asked to approve whatever this costs, it would be a reasonable place to start.
We have covered the closure since Tuesday and the cyber exposure of the surrounding cities, including Chelsea’s. We will update when the city says more, or when Thursday comes and goes.