UPDATE: This story is updated with comments from Chatham County Manager Dan LaMontagne.
The “cyber incident” which knocked out Chatham County government’s computer network, telephones and email on Oct. 28 is still ongoing nearly a week later — with the source of the breach still unknown.
In the meantime, county officials are operating with newly-created temporary email addresses and phone numbers.
At Monday’s Chatham County Board of Commissioners meeting, held completely in-person due to the cyber attack, County Manager Dan LaMontagne gave updates on the incident, stating that it “hit us like a ton of bricks.”
“The problem is really, really bad,” LaMontagne said at the meeting. “But we are starting to see little glimmers that it’s not as bad as it could be. We’ll just say that this is an ongoing investigation as far as what has happened and what the impacts are to the county.”
He said the county is continuing its efforts to get the “critical facilities,” such as Chatham’s Department of Social Services and Sheriff’s Office, up and running first, and that it will not have phone numbers to every staff person and department immediately. County officials are able to post updates to the county’s website, LaMontagne said, but staff members are having to use mobile hot spots to conduct all business.
In the original email sent by Chatham County government last Wednesday evening said it had identified a cyber incident that left its network, office phones and email “inoperable for an undetermined amount of time.”
That email was sent from a new email address for Public Information Officer Kara Dudley, pio@chathameoc.com, since the county still did not have access to its email server. A second email notice was sent early afternoon Thursday containing the same information.
Chatham County immediately notified authorities of the incident, LaMontagne said in the email, and is continuing to work toward identifying the extent of the problem.
“Chatham County 911 communications were not impacted and continue to operate without issue. Chatham County early voting also was not affected in this incident,” LaMontagne said. “We are working with law enforcement and support agencies so we can recover from this incident as soon as possible. Our priority is to restore our systems in a secure manner and maintain the provision of critical services.”
County officials would not confirm a report that the FBI was involved in the investigation of the incident, nor address questions about whether that incident involved a request for a ransom or a payment of any kind.
Though voting data was not compromised, LaMontagne said on Monday at the BOC meeting that all poll workers’ laptops were replaced “out of an abundance of caution.” The elections office was unaffected because it is connected to a state-level network and not the county’s.
“The cyber incident that was discovered on October 28th that affected Chatham County government’s network is still under investigation,” Dudley said in a follow-up email message sent Friday evening.
In that message, Dudley said Chatham County’s Management and Information Systems (MIS) Department was working to restore the affected systems, along with federal, state and local partners.
“A timeline has not been established for full service restoration at this point,” she wrote. “Updates on the restoration of services/systems will continue to be provided as progress is made. We are working around the clock to restore workstations in county departments.”
Dudley encouraged community members to monitor the county’s website and their social media channels (Facebook and Twitter) for updates.
“Everyone’s patience is greatly appreciated as we understand there have been some inconveniences and delays in service,” Dudley said. “Thank you for your continued support as we continue to work through this situation.”
Friday update, 3:55 p.m.: The following statement may be attributed to Chatham County Manager Dan LaMontagne:
“The cyber incident discovered on October 28th that affected Chatham County government's network is still under investigation. Chatham County’s Management and Information Systems (MIS) Department, along with federal, state, and local partners continue working to restore the affected systems. A timeline has not been established for full service restoration, but we continue to make progress in our efforts. Updates on the restoration of services/systems will continue to be provided.
We are working around the clock to restore workstations in county departments and adapt our processes so we can continue serving the community. These efforts include establishing temporary email addresses and phone numbers for the public to reach us. A new web page has been created at chathamnc.org/cyberincident which includes a central directory for departments’ contact information as well as Frequently Asked Questions. More specific details can be found under each department’s individual web page. The cyber incident web page is also available en Español at chathamnc.org/incidenteciber.
The community is encouraged to monitor chathamnc.org, the web pages mentioned above, and the county's social media channels (Facebook, Twitter and Nextdoor) for updates.
We have received tremendous support from the community. We greatly appreciate everyone’s patience as we continue to work through this situation.”
Reporter Hannah McClellan can be reached at hannah@chathamnr.com.