The High Stakes Of Cyber Security - Editorial
Earlier this week, Bourne police and the town issued a joint statement about a cyberattack on Bourne’s information technology infrastructure. We wish we could tell our readers more, but the fact of the matter is—that is really all we know.
The town and police are being tightlipped about what happened, something we can understand given the sensitivity of such an issue and the ongoing investigation. Cyberattacks must be taken seriously, as they can be detrimental to anyone who falls victim, whether that be an individual, a private business, or even a local government.
Just last year, in June, the Town of Arlington reported that it lost $445,945 that was intended to pay a contractor for work on a high school building project when the town was hit by a cyberattack. Through what is known as a business email compromise, cyber criminals were able to commit wire fraud by phishing, using spoofed email addresses and compromised email accounts to intercept payments intended for the legitimate contractor. Reportedly, the threat activity occurred in the town’s Microsoft system; ultimately, though, the town’s bank and insurance helped recover some of the funds and offset the losses, and the town manager said no sensitive data were compromised.
That was not the case, however, when a cyberattack all but halted the City of Lowell’s municipal operations in 2023. The attack reportedly knocked out Lowell’s phones, email, financial, human resources and asset management, and revenue systems. The breach was pretty serious, with large amounts of data being exfiltrated and the city being locked out of its own systems. The local paper later reported that five gigabytes of city data—including personal and personnel data, such as confidential medical billing records and employee disciplinary cases—was shared both in private online channels and on the dark web. An apparent threat of more data being shared unless a ransom was paid was made by a group connected to the dark web; the city reportedly did not pay the ransom, and data leaks were later connected to a Russian hacker known to law enforcement.
In the end, all computers had to be shut down, wiped and restored, and the impact was long lasting—the police department’s computer-aided dispatch system was disabled in the April 2023 attack, which was reportedly not restored until the following May. And a large amount of data was ultimately leaked.
There was another attack on Lowell’s school district the following spring, but it was far less detrimental as the cybersecurity software in place blocked the outside attempt to gain access to the district’s file server.
With so little to go on amid the ongoing investigation into the cyberattack on the Town of Bourne, we are left to wonder what happened. Looking at similar incidents in other municipalities helped us get a better idea of what could be at stake. Maybe it was similar to the aforementioned incidents; maybe it was nothing of the sort. For the sake of the town and its residents we certainly hope it is the latter, but the fact remains, we just don’t know yet. That, unfortunately, is the nature of this kind of breaking news. As soon as we do know, though, our readers will be the first to know.