ANDOVER, MA — Andover hired outside attorneys and a cybersecurity firm to investigate ransomware on the first night of the August cyberattack, according to newly released Town records.
The contracts, insurance correspondence and internal emails obtained by Andover News provide the most detailed account to date of the Town’s response to the Aug. 13 attack. The Town hired forensic specialists to determine whether the attackers stole information, monitor more than 3,000 devices and, if necessary, communicate directly with the attacker.
The initial response carried an estimated cost of at least $39,605, with the potential to exceed $44,000. The Town also filed a cyberinsurance claim within days of the attack.
Town officials have not disclosed whether they received a ransom demand, communicated with the attacker or found evidence that someone accessed or stole Town or school information.
The Town withheld records that could answer those questions, citing an “active, ongoing municipal investigation.” Officials have also declined to comment on the incident while the investigation continues.
Ransomware Response Began Aug. 13
The Town signed an agreement with outside law firm Constangy, Brooks, Smith & Prophete and cybersecurity firm Vector3 on the evening of Aug. 13, the same day the network disruption began.
The agreement described the work as “ransomware investigation and response services,” though another section referred more generally to a “potential security event.”
The Town hired Vector3 to determine how the attackers entered the network, reconstruct their activity and find out whether they accessed or removed information. The agreement authorized the company to examine as many as 10 computers or other network components and help install endpoint-detection software on up to 3,130 devices.
Vector3 also agreed to monitor those devices for 30 days. Its contract included direct communication with the unidentified attacker and monitoring of negotiation channels for as long as 60 days.
Those services were available if needed. The agreement does not confirm that the Town received a ransom demand or negotiated with anyone, and the Town withheld records that could answer those questions.
The Town retained the ransomware specialists hours before it publicly described the disruption as a temporary internet-connectivity problem. Town Manager Andrew Flanagan did not publicly confirm the cyberattack until Aug. 21.
In an Aug. 17 email to employees, Flanagan said the Town learned while restoring services on Friday, Aug. 14, that a cybersecurity incident had caused the outage.
Initial Costs Exceed $39,000
Vector3 estimated that its work would cost $30,105, including:
- $20,000 for the forensic investigation.
- $3,975 for containment and restoration assistance.
- $3,130 for endpoint monitoring.
- $3,000 for potential communication with the attacker.
The agreement barred Vector3 from exceeding that amount without additional authorization from the Town or its attorneys.
The Town agreed to pay Constangy an initial fixed fee of $9,500. The firm’s work included coordinating the forensic investigation, determining whether the Town had a legal duty to notify anyone, assisting with public communications and working with law enforcement.
Constangy could charge another $4,500 if the Town needed help notifying affected people or regulators and arranging credit or identity-monitoring services. The firm would bill other regulatory work at hourly rates ranging from $175 to $350.
Together, the two agreements authorized initial costs of up to $44,105, excluding other hourly work and expenses.
The records do not show how much the Town has paid. Andover News requested invoices, purchase orders and payment records, but the Town provided only the two agreements and did not say whether other financial records existed.
The Town reported the incident to its cyberinsurance carrier, Tokio Marine HCC, which acknowledged the claim on Aug. 17.
The Massachusetts Interlocal Insurance Association said in an email that the Town appeared to have reported the claim outside regular business hours.
The Town’s policy provides up to $1 million in coverage for several types of cyber expenses, including breach response and network restoration. It also provides up to $100,000 for cyber-extortion costs. Most categories carry a $10,000 retention, which the Town generally must pay before coverage begins.
The insurer said Aug. 17 that it was reviewing the claim. The records do not include a final coverage decision or any insurance payments.
Recovery Continued Beyond Four Days
The Town’s technology recovery continued beyond the four-day outage initially reported.
Email, wired internet access and several major municipal systems began returning Aug. 17. The Town restored printing, Wi-Fi and its technology help desk Aug. 18, followed by library systems and online bill payment Aug. 19.
The Town did not fully restore Town and school shared-network drives until Aug. 21, eight days after the attack began.
Virtual private network access remained unavailable after Aug. 21 while the Town redesigned and rebuilt that system. Officials had not set a completion date.
The Town restored its MUNIS financial-management system with data from a backup created at midnight Aug. 12. Employees had to re-enter work performed later that day.
Critical public-safety services, municipal buildings, telephones and Town-operated utilities continued operating during the disruption.
Questions About Stolen Data Remain
Flanagan told employees Aug. 17 that investigators were working to determine whether the attack affected personal or sensitive information.
The Town withheld records concerning any ransom or extortion demand and any notifications to state or federal agencies. It cited exemptions in the Massachusetts Public Records Law for active investigations and records whose release could jeopardize cybersecurity.
The Massachusetts Attorney General’s Office told Andover News that it had received no data-breach notification from the Town under Chapter 93H as of Sept. 22. The law governs breaches involving certain types of personal information.
That does not rule out the possibility that someone took information from the Town’s network. Investigators may still be reviewing the attack, the compromised files may not contain information covered by the law, or Town officials may have determined that the law does not require notification.
The Town also said it found no communications among the Town and school officials named in the records request that mentioned WallStreet, the ransomware group that listed Andover as a purported victim on a dark-web site Aug. 30.
A listing on a dark-web site does not prove that a group breached an organization or stole its information. The Town has not publicly attributed the attack to WallStreet or any other group.
