State of emergency declared after cyber attack on Mat-Su Borough

PALMER — A state of emergency was declared by Mat-Su Borough Manager John Moosey following the cleanup process around a cyber attack that has shut down borough email, servers, and Internet. The attack that came in late Monday night may have been in the system for a month, according to Borough IT Director Eric Wyatt. When it began its attack, the 30-person staff at Borough IT doubled as all hands were on deck to fight off the attack.

“We very quickly realized that this is way beyond anything we have dealt with before. We Called the FBI in and they were there that afternoon,” said Wyatt.

Now a week after the attack, Wyatt says that all of the damage is over and the threat is contained. IT staff are still working to investigate some of the areas the viruses went, but most of the data should be retained. Wyatt said that these types of viruses were targeted at local governments like the Mat-Su Borough and the city of Valdez, which was also effected by the cyber attack, because they have been unsuccessful with attempting to attack the federal government. Knowing that local governments have smaller budgets for cyber security, the attackers went after the borough’s backup data records and disaster recovery systems. Most borough phones and emails are back up as of Wednesday. More than 200 other organizations have been hit with this virus as well. What was unique about the attack is that it was not just one virus that attacked, it was many. Cryptolocker, time bomb, trojan horse and dead man’s switch viruses were all incorporated into the attack.

“We get attacks like this, literally millions of them, and we repel millions of them constantly. We had one two years ago that got through and did get files on one computer. It was repaired within a couple of hours,” Wyatt said. “This was a much more insidious attack comprised of more components. It had gotten much deeper into our system before it actually attacked. When we see them, we have software written so it recognizes them. This is out and attacks you before there’s any defense for it so essentially we’re defenseless.”

Wyatt was incredibly pleased with the response of the community as consultants, former employees, and vendors flocked into help, and doubled Wyatt’s staff. Wyatt was so warmed that those who could help came and worked together, some who even compete in the private sector but were working in conjunction to help and try to stop the attack.

“The outpouring of support from the community and the way the community has come together has been fantastic. We are going to have to come together to try to beat this so I’m very proud of our community,” Wyatt said.

Wyatt said that the state of emergency declared by the manager was because the size and scope of work need to repair the damage was so large, it constituted accessing previously set aside funds for the emergency. The borough did not write a letter to the governor to try and receive FEMA funds, which Wyatt said would have been the next step. Wyatt also commended the response of the FBI Cyber Crimes Division. Once Wyatt realized the complexity and sophistication of the attack on the night of July 23, he called the FBI early on Tuesday. They showed up before lunch. Wyatt, his staff, band of supporters, and the FBI are working to write security that recognizes these viruses, so that they won’t be vulnerable to them. The security already in place for the borough stops many viruses that try to get in, but there are occasionally viruses that slip through. These common attacks have had their signature changed by whoever wrote them, so the borough’s protection devices could not recognize them before it was too late.

“We’ve never had an attack this large on the Borough. We will write systems that will defend against it and rebuild systems that will defend against it, but then they will change it again so there will be others come after us,” said Wyatt.