Price tag for cyberattack on Mat-Su Borough now tops $2 million

PALMER — It's cost more than $2 million to respond to the cyberattack that paralyzed Matanuska-Susitna Borough computer systems for weeks this summer.

The borough's systems still aren't totally back online as officials finish recovering from the pervasive malware and build in security upgrades deferred in the past.

The devastating attack took out 650 desktop computers and servers three months ago, knocking offline everything from landfill receipts to borough email.

Now borough administrators are asking the Mat-Su Assembly to move $1 million into emergency reserves to help cover the costs. The Assembly meets Tuesday night.

The request is for $500,000 from a repair and renovation reserve and another $500,000 from a capital expenditures reserve.

The money is paying for recovery — "cleaning" virus-infected computers and servers — but also improving the security system with upgrades deferred in past years, borough IT director Eric Wyatt said Thursday.

"I couldn't just bring us back to where we were," Wyatt said. "I have to bring us back to an improved state."

About 35 to 45 percent of the spending is for improvements that should put the borough two or three years ahead on security projects, he said.

But the cyberattack effects still linger in the system.

Parents trying to register children for swimming lessons can't do that online yet, though that's a few days away, officials say.  Earlier this week, the borough's popular property parcel viewing site came back up.

Limited access is slowing some public records requests. The borough records management system survived completely but some historical email has been lost, Wyatt said. Ongoing projects, like road or building projects, also aren't entered in that system until they're complete so some of that data may be lost.

Employees generally can't use external storage devices like thumb drives right now to prevent more infection from viruses.

The borough declared an emergency over the cyberattack in late July, requesting help from state disaster money but that request hasn't been approved.

Officials also expect to tap a cyber insurance policy with possible reimbursement of up to $1 million. That policy won't cover all of the costs, but it will cover aspects, Wyatt said.

The cost of responding to the attack is approaching $2.1 million, according to a memo attached to the Assembly proposal.

That number could rise slightly due to the cost of establishing whether hackers stole data and any future notifications that might be necessary, Phillips said.

Mat-Su was one of many governments hit by similar attacks.

Officials initially said it cost an average of $1 million to recover. But, Wyatt said, widespread and severe attacks over the summer drove up the "price tag" to an average of $3.5 million for an organization the size of the borough.

Within just a month of a March malware attack, the city of Atlanta had already spent $2.7 million, the Atlanta Journal-Constitution reported. That total didn't include legal fees, and was expected to rise substantially.

That number could hit $17 million, the Journal-Constitution reported in August.

The paper also reported that the Colorado Department of Transportation was estimated to have spent $1.5 million to get computers back up and running after ransomware attacks in February and March.

Meanwhile, Wyatt said, some victims of cyberattacks are taking six months or more to recover.

"We're actually doing pretty well," he said.

The city of Valdez was also the victim of malware in which electronic data was held for "ransom" that the city didn't pay, according to a report in the Valdez Star. The city rebuilt its IT systems but employees now have totally new email addresses.