Commissioners: Cyber security incident in May possibly exposed personal data

The cyber incident that affected Lorain County government computers in May may have exposed the personal information of county employees and vendors — including Social Security, bank account and bank routing numbers, the Board of Commissioners said Friday. A news release emailed to The Chronicle-Telegram at late Friday was the first development in the matter since county officials announced June 2 that county computer systems were back up and running. The Board of Commissioners — Republicans Jeff Riddell, David Moore and Marty Gallagher — said in a news release that officials "commenced an immediate and thorough forensic investigation ... aimed to determine the extent of the activity and whether individual personal information, if any, may have been accessed or acquired by an unauthorized party." "At the conclusion of the investigation, we learned that a limited number of files containing personal information related to our employees and vendors were potentially impacted," the board wrote. "The personal information potentially impacted includes Social Security numbers, bank account numbers, and routing numbers." More specifically, Riddell on Friday said whomever improperly accessed the information on the county computers "got in and encrypted it." "To the best of our knowledge, this incident impacted information only contained in the Lorain County Auditor's Office," the Board of Commissioners said. "Further, we have no evidence that information from any other county department was impacted in this incident." The cyber incident described by county officials happened the last week of May 23. Commissioners said they first became aware on May 23, the Friday before Memorial Day, though the incident was not publicly acknowledged until The Chronicle-Telegram inquired about it the following week. The news release said Commissioners learned May 23 "that an unauthorized party obtained access to internal records of the Lorain County Auditor's network." Auditor Craig Snodgrass, a Democrat, said both in May and again Friday the first indication his office had that anything was wrong was the morning of May 27, the first day back after the three-day Memorial Day weekend. The discrepancy in timing couldn't immediately be explained. The county's insurance company had experts working with law enforcement on the issue, county officials said in May. Snodgrass said Friday he didn't want to say anything more that could compromise the ongoing cyber security investigation. Cybersecurity professionals working with the county, "this is what they do. It's their jobs. It's really hopefully toward the end of it all. There's things they have to go through and do," he said. The Auditor's Office's digital information network is separate from other county networks that contained sensitive data, Snodgrass said in May. His office "never shut down" during the incident, Snodgrass said Friday. Several county courts in the county Justice Center in Elyria closed for the day May 30, a Friday, but reopened the following week. Commissioners said critical county infrastructure such as Lorain County 911 was not affected and remained operational. Most county computer networks were briefly taken offline as a precaution and all were brought back up by June 2. "While we have no indication that there has been any fraud as a result of this incident, Lorain County reminds its employees and vendors to remain vigilant in reviewing financial account statements on a regular basis for any fraudulent activity," Commissioners wrote, adding that the board "is committed to protecting the privacy and security of our employees' and vendors' personal information." Lorain County "understands the importance of safeguarding individual personal information," the board wrote, and "remains fully committed to maintaining the privacy of personal information in our possession." "Immediate action" was taken to protect individual personal information when the cybersecurity incident became known, Commissioners wrote. The county "continually evaluates and modifies its practices to enhance the security and privacy of personal information and are taking measures to augment its existing cybersecurity," the board wrote. That recently included spending $230,000 to upgrade the county's cybersecurity defenses, the latest in upgrade in a years-long process, officials said. Contact Dave O'Brien at (440) 329-7129 or dobrien@chroniclet.com