Oak Ridge spends half-million dollars so far recovering from malware attack
Three weeks after Oak Ridge's computer network was hit by a malware attack, city officials have spent half a million dollars on recovery efforts - and more might be needed before the city's network is completely back online.
At Monday night's Oak Ridge City Council meeting, Oak Ridge Electric Department Director Ardo Ba said the reading of utility meters for residences and businesses would restart April 11. The Utility Business Office can now accept cash and checks for utility payments and post that information on payments to the appropriate accounts. He told council members that - unless there are unforeseen circumstances - the Utility Business Office can begin accepting credit card payments by the end of the week.
March and April utility bills for water, sewer and electricity will be sent out to customers soon, about 6,000 by the end of this week, he said. No late fees will be charged.
Amy Fitzgerald, the city's intergovernmental affairs director, gave a report to City Council on what had occurred since the March 20 attack. Among the report's highlights:
A total of $515,813 has been spent by the city so far in emergency purchases. This includes IT support, forensic analysts work, computer and network hardware, subscriptions for credit monitoring, antivirus detection services, "hot spots" for internet needs, and legal assistance.
There is still no evidence any city customers' credit card information has been compromised.
A file containing information on city personnel was accessed, but there is no evidence information was shared. As a precautionary measure, the city is subscribing employees to a credit monitoring service.
In regards to March and April utility bills, Ba said half of the customers had their meters read before the March 20 malware attack. The remaining half of the customers utility usage, as well as all residences and businesses' usage from March 20 to April 11 will be estimated, he said.
"I'm so grateful for my colleagues" and people in the community who were so understanding of the problems, Fitzgerald said. She said city workers had put forth an "extraordinary effort" with following a disaster recovery plan that was already in place, but instead of a tornado it was a malware attack.
The attack involved the insertion of malicious programs, often called “malware” or “computer viruses,” into the city’s computer network.
Deputy City Manager Jack Suggs presented a timeline, including the discovery of the attack on March 20, when city technicians disconnected all the city government's assets from the network and internet and then shut down the computer system. This shut down every business-like function in each department, utility billing, all city emails, the city website, and other systems.
The city was still able to offer police, fire and utility services, but the billing was a problem.
Fitzgerald said there is no "100% guarantee" that new purchases and procedures will prevent another malware attack, but it will be less likely than before. She said computer and internet assistance during this time has been provided by personnel from Oak Ridge Schools, Oak Ridge National Laboratory and others.
Suggs pointed out that two payrolls for city employees had been achieved, as would likely a third before the computer system is completely back online.
Donna Smith is The Oak Ridger’s news editor and covers Oak Ridge area news. Email dsmith@oakridger.com. Twitter: @ridgernewsed.
Support strong local journalism by subscribing at https://subscribe.oakridger.com/offers.
This article originally appeared on Oakridger: Oak Ridge spends half-million dollars recovering from malware attack
