For four days this week, a city of 50,000 people two miles up Broadway has had no working City Hall. Everett’s clerks, assessors and tax collectors have been taking walk-ins at a senior center because somebody got into the city’s network on a Sunday night. Nobody in Everett has said yet how. The question for Chelsea is not whether the same thing could happen at 500 Broadway. It is what the city has done to get ready for it.
Chelsea has not reported a cyberattack on its own systems, and nothing in this article suggests one has occurred. But the conditions that made Everett a target are the conditions of every small city in Massachusetts, and Chelsea shares most of them.
A small department, a big surface
Chelsea’s Information Technology Services department works out of Room 109 at City Hall. Its website lists five people: Chief Information Officer Ramon Garcia, an IT manager, a technical lead, a system analyst and one other staff member. That team supports every department in a city government that will spend $116.1 million on the municipal side this year out of a $272.4 million budget. The Chelsea Record’s coverage of the June budget hearings did not report the IT department’s line, and the city’s online budget book lists it only as account 155.
Everything those five people defend keeps growing. At the May budget hearings, Police Chief Keith Houghton described a department that “is run on many different platforms,” with separate software and licenses for body cameras, the city’s street cameras and other systems. Each of those platforms is a login, and a login is a door.
The pattern in this year’s Massachusetts attacks is not exotic. Andover lost a shared town-school network for four days in August. Attleboro lost phones and email for days last November. Everett lost City Hall. In each case public safety radio and 911 stayed up, and in each case the ordinary business of government, permits, payments, records, payroll, stopped.
The 911 question
Chelsea is in the middle of moving its emergency dispatch out of the city. The council voted in March 2025 to join Revere and Winthrop in the Metro North Regional Emergency Communications Center, which will operate from the renovated McKinley School at 65 Yeamans Street in Revere. Ground was broken in April and the center is due to open in 2027.
Regional dispatch centers are generally better staffed and better funded than a single city’s dispatch room, and that includes their technology. But they also concentrate risk. In April, a cyberattack on the Patriot Regional Emergency Communications Center in northern Massachusetts disrupted systems for Pepperell, Ashby, Dunstable, Groton and other towns at once. Call-taking continued, but the incident is a reminder that when Chelsea, Revere and Winthrop share one center, they will share one target. How the new center’s network will be separated from the three city halls it serves is a question worth asking before it opens.
The alert system nobody thinks about
Everett’s first cyber problem was not its own. Last December the vendor behind CodeRED, the text and phone alert service Everett used for snow emergencies and water outages, was breached nationwide, exposing subscriber names, phone numbers, email addresses and passwords. Everett had to tell residents to change passwords on a system it could no longer log into, and it switched vendors in January.
Chelsea’s City Alerts page on chelseama.gov did not load for us this week, so we could not confirm which vendor the city uses for resident alerts. Whichever it is, the CodeRED breach showed that a city’s exposure includes every outside company that holds its residents’ contact information.
What the state offers, and what we do not know
Massachusetts has built a menu of free or subsidized help for cities Chelsea’s size, and whether Chelsea has taken it up is the most useful question a resident or councillor could ask.
- Cybersecurity Health Check. A free assessment run by the state’s Office of Municipal and School Technology. In June the state gave its first $1 million in Cybersecurity Remediation Grants to 20 communities and districts to fix what those assessments found, mostly aging hardware. Chelsea was not among the two recipients named in press coverage; the full list has not been published in the reports we reviewed.
- Cybersecurity Awareness Program. Free phishing simulations and employee training from the Executive Office of Technology Services and Security. Most municipal breaches still start with a clicked link.
- Cyber Resilient Massachusetts grant. A $2 million MassCyberCenter program that pays CyberTrust Massachusetts to watch a municipality’s network around the clock for up to three years.
- Minimum Baseline of Cybersecurity for Municipalities. The MassCyberCenter’s four-part standard: trained employees, threat sharing, an incident response plan, and a secure technology environment.
The federal Cybersecurity and Infrastructure Security Agency’s list for local governments is short and specific: keep offline, encrypted backups and test them; require multi-factor authentication, especially on email and remote access; patch promptly; separate networks so one infected computer cannot reach everything; give employees only the access their job needs; and write down, in advance, who does what when the screens go dark.
Questions for City Hall
These are the questions worth putting to the City Manager’s office and the council. We will publish any answers the city provides:
- Has Chelsea completed a state Cybersecurity Health Check, and has it applied for remediation funding?
- Do city employees use multi-factor authentication for email and remote access?
- Are the school department’s network and the city’s network separated, as Everett’s were?
- When were the city’s backups last tested by restoring from them?
- Does the city carry cyber insurance, and does it have a written incident response plan?
- How will the Metro North dispatch center’s network be isolated from the three member communities?
Everett will reopen City Hall eventually. The city that learns something from Everett’s week is the one that asks these questions before it has to.
Sources: City of Chelsea website, Information Technology Services and Emergency Management pages; Chelsea Record, May 21 and June 11, 2026; Chelsea Record and Winthrop Transcript, March 6, 2025; City of Revere, April 2026; City of Everett notices, September 7 and 8, 2026 and December 1, 2025; Recorded Future News, April 3, 2026; MassCyberCenter; Mass.gov; StateScoop and Government Technology, June 2026; CISA Ransomware Guide. Photo: Chelsea City Hall by Daderot via Wikimedia Commons, CC0.