Petersburg Borough

Summary

Petersburg Borough disclosed a ransomware attack that compromised utility billing software and exposed customer names and utility account numbers, though it could not confirm whether attackers viewed or copied the records. The borough, which serves communities in Southeast Alaska, stated that existing security measures failed to fully prevent the intrusion and that credit card and banking information was not stored on the affected network. Its technology provider worked to halt the attack, secure the network, and investigate, while state public safety officials and the FBI were notified. Public disclosure was delayed on advice that attackers might still be monitoring the borough, and employees were notified through hand-delivered notices or direct conversations. The borough has not identified the attackers, disclosed any ransom demand or payment, or specified which billing functions were affected, how long the disruption lasted, or when restoration was complete.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 11, a ransomware attack affected utility billing software operated by Alaska's Petersburg Borough. The borough government serves Petersburg and surrounding areas in Southeast Alaska, with the town located on the northern end of Mitkof Island approximately 120 miles south of Juneau. The intrusion was not disclosed publicly until more than three months later, when the borough posted a community notice on a Friday. An assembly agenda posted the Thursday before that notice had already identified the ransomware attack and called for a closed discussion of network vulnerabilities and security responses at the following Tuesday's assembly meeting. In the notice, borough officials acknowledged that security measures were in place but did not fully prevent the attack. The notice did not establish whether attackers viewed or copied customer records, though customer names and utility account numbers were accessible through the affected software. Petersburg has not identified the attackers, nor has it disclosed a ransom demand or any payment. The borough also has not disclosed which specific billing functions were affected, how long the disruption lasted, or when the software was fully restored.

Customer names and utility account numbers were accessible through the compromised utility billing software, but the borough did not confirm theft of other customer information. Officials stated that customer credit card and banking information was not stored on the compromised network and therefore was not accessed during the attack. A separate notice issued on October 6 attributed delayed September utility statements to a server issue, and the borough has not linked that delay to the July ransomware attack. Employees were informed of the incident through hand-delivered notices or individual conversations. Officials said they were advised to limit public disclosure because the attackers might still be monitoring the borough. The borough's technology provider, Professional Computer Solutions, took steps to stop the attack, secure the network, and investigate the intrusion. Alaska's Department of Public Safety and the FBI were notified of the incident. The borough has not provided further details on the extent of data access or the timeline for full system recovery beyond what was included in the community notice.

Sources

Sources available to members: 1 source.