Bella Vista cyber attack costs city more than $132,000 | The Arkansas Democrat-Gazette

BELLA VISTA — The cyberattack on the city in August resulted in costs totaling more than $132,000, but the city’s cyber insurance policy through the Arkansas Municipal League is expected to cover nearly half of that.

The Bella Vista City Council on Monday approved 5-0 a resolution to add $132,849 to the IT budget to cover costs. Councilman James Wozniak was absent.

The total cost is a combination of expenses, Information Technology Director John Moeckel told the City Council during an Oct. 21 work session. These expenses include the cost of work performed in the immediate response to the cyber attack and the costs of corrective actions and improvements to the cyber attack. the city’s computer systems to make them more secure, he said.

The total price tag reflects the forensic investigation the department had to complete, as well as recovery assistance and specialized technical support from outside sources, Moeckel said.

“We had some issues getting our court system back online, and we had to contact the vendor that provides our court system and we had some billable hours there,” he told the council, which received details of the costs in meeting documents during the meeting. work session.

Employee overtime costs are separated in the meeting documents because they are billed separately to the insurance company, Moeckel said.

“The rest of the items after the overtime items are improvements that we believe will improve our safety here and help maintain our facilities,” he added.

Moeckel said the department expects $65,820 of that to be reimbursed by insurance. He has been in contact with Municipal League IT director Jeff Melton, who “has been a tremendous resource throughout the process,” Moeckel said.

Moeckel is confident the cyber insurance will cover the city’s costs related to investigation, remediation and support — with the exception of employee overtime, he told the council.

It is good news that a new Cyber ​​Response Board has been established at the state level, Moeckel added.

The Arkansas Cyber ​​Response Board was established pursuant to Act 846 of 2023 to administer the Arkansas Self-Funded Cyber ​​Response Program to provide coverage for cybersecurity incidents, risks, damages, or losses caused by a cyber attack on a participating government entity, the governor’s office said.

Melton plans to advocate for the city at the November board meeting, Moeckel said.

“He believes he can get paid for the overtime from a fund that we pay into,” he said.

Councilman Jerry Snow asked at the Oct. 21 meeting about the company hired to monitor the city’s computer systems 24 hours a day and whether its services were effective during the attack.

“They were an absolute lifesaver during this event,” Moeckel said. “They called me at home and warned me that something strange was going on. They were taking containment actions and things like that, so yeah, they were a huge benefit.”

Snow also inquired about the origins of the attack and how the city came to endure such an event. Moeckel said the full investigation report is still being written, but council members are welcome to attend a briefing once the report is ready. He said these types of attacks are sophisticated and that he did not want to discuss the details at a public meeting.

According to a city press release on August 26 – the day before the city offices and library reopened to the public after being closed for six business days – the cities of Springdale, Fayetteville, Fort Smith and Siloam Springs, along with Benton counties and Washington sent IT staff to Bella Vista to assist with the recovery process.

As offices reopened, some systems continued to be repaired, including those at the courthouse. However, the city did not have to pay a ransom and there was no breach of personal information, according to the press release.

All city network systems were shut down on August 19 after the attack was identified the night before. Offices closed and city employees worked remotely as much as possible throughout the week.

The police and fire response was not disrupted as these departments operate on a separate, unaffected system, the news release said.

The closure of the city’s network occurred three weeks after Northwest Arkansas Community College was hit by a cyberattack, leading to the network’s closure. As a result of the incident, the start of classes in the fall semester was postponed by a week.