Having spent several decades providing technology advice to companies and agencies large and small, I have long harbored concerns about small municipalities’ IT security and stability. The threats just get stronger every year and small cities with small IT staffs and budgets struggle to keep up in the best of times. That chicken came home to roost in Foster City this week as the SF Comicle reports:
Foster City officials said Friday that a ransomware attack was “widely impacting” municipal services, and that city leaders planned to issue a state of emergency in an effort to marshal assistance and funding from outside agencies.
Officials said in a statement that while emergency services like 911 were “functional and unaffected,” information and services that rely on the city’s computer network would likely be inaccessible Friday. City Hall remained open to the public Friday, although officials said “limited services” were available there.
“Out of an abundance of caution, those who have done business with the City of Foster City are encouraged to change their personal passwords and take measures to protect their personal data,” the city said.
I’m not sure what “personal data” the City of Burlingame might have on us aside from an email address if you subscribe to getting council or commission agendas sent to you. Same goes for the alertcrimegraphics feed. They would hold emails you sent to staff or electeds (at their official addresses), but you can’t “change” that. There’s one’s water bill which makes for a dull read. Local business owners probably have a deeper data profile. In any case, this breach and the ransomware demand are a word to the wise. There are a variety of low-to-high-cost consultants and auditors out there and one would hope city staff are availing themselves of knowledgeable advice. Fifty or a hundred grand every couple of years is money well spent.
