Springfield’s public schools learned this week that student and staff information was taken in the cyberattack on the district earlier this month. The FBI told city officials on Tuesday. The district is arranging free credit monitoring and says it will notify employees once it knows more. “The full extent of exactly what information was breached and where the information has been leaked remains under investigation,” the district said.
Everett found intruders on its own network on the evening of Sunday, September 6. Ten days later the city has not said whether anything was taken.
Two cities, two postures
The comparison is not a criticism of either city’s technical response, which outsiders cannot judge. It is about what residents are told and when. Springfield’s announcement came the day after federal investigators briefed the city, and it did three things: it stated that a breach of personal information had occurred, it identified whose information was at risk, and it named a remedy. It was careful about what remains unknown, including whether staff Social Security numbers were among the data, and it noted that the district does not typically keep student Social Security numbers in student files.
Everett’s public statements have been about operations. City Hall closed to the public on September 8. The notice on the city’s website now reads “City Hall Closed Sept. 14-17,” with basic services running out of the Connolly Center on Chelsea Street and 311 taking calls. Everett City Hall is closed on Fridays in the ordinary course, so the next scheduled day it is open to the public is Monday, September 21. Police, fire, the schools, public works, the libraries and third-party online bill payment have continued. Mayor Robert Van Campen said in the first days that “our priority is to ensure the security of our systems and infrastructure while also investigating the full scope of the incident.”
What the city has not said is what kind of attack it was, whether any personal data was accessed, whether anyone demanded money, or when it expects to know. Everett holds the payroll and personnel records of its municipal workforce, and assessing, tax, permitting, licensing and 311 records for its residents.
The pattern in the region
Springfield is the third Massachusetts municipal network to go down since August. Andover’s shared town and school network was out for four days beginning August 13, taking email and online bill payment with it just before the school year. A ransomware group calling itself WallStreet later listed Andover on its leak site, a claim the town has not confirmed. Everett came next, then Springfield.
The sequence matters because of the lag. In each case the interruption to service is visible in days. Whether data left the building becomes clear in weeks, often only after an outside party, a federal agency or the attacker’s own leak site, says so. Springfield’s notice came from the FBI, not from the district’s own forensics.
Massachusetts law requires that when personal information is breached, the holder of that information notify the Attorney General, the director of consumer affairs and business regulation, and each affected resident, “as soon as practicable and without unreasonable delay.” The clock on that runs from when a city knows, and knowing takes time. Nothing in Everett’s silence is evidence that anything was taken. It is also not evidence that nothing was.
What Chelsea should take from it
Chelsea’s information technology department is five people under Chief Information Officer Ramon Garcia. When Everett’s network went down we put six questions to City Hall: whether Chelsea has completed a state Cybersecurity Health Check and applied for remediation money, whether employees use multifactor authentication for email and remote access, whether the school and city networks are separated as Everett’s were, when backups were last tested by restoring from them, whether the city carries cyber insurance and has a written incident response plan, and how the Metro North dispatch center’s network will be isolated from its three member communities. We have had no answers.
The Metro North regional dispatch center, which will handle 911 for Chelsea, Revere and Winthrop from the former McKinley School in Revere, opens in 2027. Everett’s former information technology director of ten years was arraigned Friday on a larceny charge involving the city’s purchasing account, and the interim who followed him described systems “15 to 20 years behind current standards.” Chelsea’s council has not taken the subject up in public this year.
Everett has now gone ten days without saying what happened to it. The next scheduled public day at 484 Broadway is Monday. What the city says then, about the data as much as the doors, is the thing to watch.